A sprawling credential dump has emerged from the shadows of cybercriminal infrastructure, and its scope is difficult to overstate. Dubbed FortiBleed, the leaked dataset contains what security researchers have independently verified as authentic VPN credentials for approximately 73,932 FortiGate firewall URLs spanning 194 countries and touching nearly every major industry sector on the planet. If your organization runs a Fortinet appliance with internet-facing management interfaces — and hundreds of thousands do — this is not a story to skim.
What Was Exposed and Who Is Affected
The compromised data first surfaced when a security researcher discovered an improperly secured server containing structured files of Fortinet VPN credentials, including usernames, plaintext passwords, and email addresses. What distinguished this collection from typical credential dumps was its unmistakable operational character: each entry was annotated with organizational metadata — industry classification, estimated revenue, employee headcount — suggesting this was not a passive data hoard but an active attack-planning database.
Among the named organizations represented in the dataset are household names spanning telecommunications, financial services, manufacturing, and technology. Government agencies and critical infrastructure operators appear alongside Fortune 500 corporations, making this a cross-sector emergency rather than an isolated incident.
Independent verification by multiple cybersecurity researchers confirmed the authenticity of the credentials — including complex, high-entropy administrative passwords that would not be recoverable through conventional brute-force methods alone.
Geographically, the affected devices are concentrated in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates, though the breach's reach extends far beyond those borders given its 194-country footprint.
The Attack Infrastructure Behind the Leak
What makes FortiBleed particularly alarming is the evidence of the operational infrastructure that produced it. Analysis of artifacts inadvertently left exposed on the same server — including scripts, connection strings, logs, and cron job outputs — paints a picture of a sophisticated, resource-intensive credential harvesting campaign.
According to researchers who reviewed those artifacts, the threat actors behind the campaign allegedly conducted approximately 1.16 billion authentication attempts against over 320,000 FortiGate targets, alongside more than 2 billion attempts against Microsoft SQL Server systems. Intercepted SSL VPN authentication hashes were reportedly cracked using a 45-GPU cluster managed through Hashtopolis, an open-source distributed hash-cracking framework favored by well-resourced adversaries.
The recovered credentials were then reportedly leveraged to move laterally into internal Active Directory environments — a classic pivot technique that transforms a perimeter breach into full domain compromise. Researchers noted that several organizations across multiple countries, including a NATO-affiliated defense contractor, appear to have been fully compromised, with classified materials allegedly exfiltrated.
The operation has been attributed to a Russian-speaking multi-operator threat group, though formal attribution has not been officially confirmed at the time of publication.
Configuration Data, Not Just Password Spraying
A critical technical detail sets FortiBleed apart from ordinary credential stuffing incidents. Researchers examining the data noted that it contains information — including administrative email addresses — that is only accessible through exported Fortinet device configurations, not through external authentication probing alone. This strongly suggests the attackers had a method of extracting full device configurations, potentially through exploitation of one or more Fortinet vulnerabilities.
The presence of complex, high-entropy passwords that could not realistically have been cracked from external hashes further supports this theory. The exact vulnerability or access vector used to obtain the configuration data has not yet been identified, and no responsible disclosure has been made to date.
Researchers also confirmed that the affected IP address ranges differ from those seen in a prior Fortinet credential leak earlier in 2025, ruling out recycled data and indicating this represents a fresh, more extensive compromise. Network analysis suggests the FortiBleed dataset encompasses roughly half of all internet-accessible Fortinet firewalls globally — a staggering proportion of the enterprise security infrastructure that organizations worldwide trust to protect their networks.
What You Should Do
Organizations running FortiGate appliances must treat this as an active incident until proven otherwise. Immediate steps include:
The Broader Implication
FortiBleed is a stark reminder that enterprise network security appliances — firewalls, VPN concentrators, and remote access gateways — have become among the most aggressively targeted assets in the modern threat landscape. These devices sit at the boundary between trusted internal networks and the hostile internet, and they are increasingly the initial access vector of choice for sophisticated threat actors.
The scale of this operation, from its GPU-accelerated cracking infrastructure to its meticulous organizational profiling of targets, reflects a level of resourcing and discipline associated with organized criminal groups or state-adjacent actors. Organizations cannot afford to treat perimeter devices as set-and-forget infrastructure. Active monitoring, aggressive patch cycles, and strict access controls are the baseline — not the ceiling — of responsible security posture.
