The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning Fortinet customers to secure FortiGate devices after a data leak known as “FortiBleed.” According to CISA, credentials associated with Fortinet firewall and VPN systems have been exposed, with reporting citing tens of thousands of affected credentials and a large number of potentially impacted internet-accessible devices.
Multiple outlets describe the issue as involving FortiGate appliances accessible from the internet and note that attackers are attempting to use the exposed access information for malicious activity. CISA’s guidance focuses on actions Fortinet users can take to reduce risk, including reviewing and securing configurations and applying appropriate remediation steps.
One report references an observed scale of exposure, citing a figure of 74,000 credentials exposed, while another cites a higher number of internet-facing devices (86,644) associated with the FortiBleed activity. Both accounts characterize the activity as an ongoing campaign and cite attribution to Russian-speaking threat actors, though specific individuals or groups are not named in the provided excerpts.
