Hackers breach 73,000 Fortinet firewalls using old passwords

Key Takeaways

• Over 73,000 Fortinet devices compromised globally using leaked passwords, not zero-day vulnerabilities
• Major companies affected include Samsung, Oracle, Accenture, Lenovo, Siemens, and PwC
• Compromised firewalls are being weaponized to harvest more credentials, creating a self-sustaining attack loop

Cybercriminals have breached tens of thousands of Fortinet firewalls and VPNs at major corporations worldwide, and the attack method is embarrassingly simple: old passwords that were never changed.

The campaign, dubbed FortiBleed by researchers, has compromised devices at Accenture, Samsung, Oracle, Lenovo, Siemens, Foxconn, Comcast, and PwC, according to reports published this week by cybersecurity firms Hudson Rock and SOCRadar. Hudson Rock estimates over 73,000 unique Fortinet URLs have been hacked. SOCRadar puts the number above 30,000.

The attackers aren't exploiting some sophisticated zero-day vulnerability. They're scanning the internet for exposed Fortinet devices, then breaking in with lists of previously leaked passwords. Once inside, they turn the firewall itself into a listening post.

How the attack feeds itself

The mechanics are straightforward but devastating. Hackers use automated tools to find Fortinet firewalls and VPNs exposed to the public internet. They try known passwords. When one works, they don't just steal data. They monitor all traffic passing through the device, collecting fresh credentials in real time.

"Those freshly collected passwords are then fed back into the scanner to compromise even more devices. The system feeds itself," SOCRadar wrote in its report.

This self-sustaining loop explains the scale. According to research findings, the campaign has launched over 1.16 billion brute-force and credential-stuffing attempts against Fortinet interfaces. Devices in 194 countries have been affected, with India, the United States, Taiwan, and Mexico seeing the highest concentrations.

Which industries are most exposed?

IT services tops the list of affected industries, followed by construction materials and telecommunications. Government agencies are also among the victims, per SOCRadar. Both security firms attribute the campaign to Russian-speaking threat actors.

The affected companies have been largely silent. Lenovo acknowledged TechCrunch's request for comment but didn't respond. Accenture, Comcast, Foxconn, Oracle, Samsung, Siemens, and PwC didn't reply. Fortinet itself has not commented.

Security researcher Bob Diachenko first reported the campaign over the weekend. Kevin Beaumont analyzed the leaked credential data independently and confirmed it "is legit" in a blog post Wednesday.

Why this keeps happening to Fortinet devices

Fortinet firewalls have been targeted repeatedly in recent years, usually through vulnerabilities in the software. This attack is different. There's no clever exploit chain, no unknown bug. The attackers are simply trying passwords that shouldn't still work.

The root problem is basic credential hygiene. Companies deploy firewalls with default or weak passwords, expose management interfaces to the public internet, and never rotate credentials. When those passwords appear in breach databases, attackers scoop them up.

Discussion on HackerNews has centered on this recurring failure. Users debated whether hardware vendors should enforce stricter security defaults, and whether corporations bear more blame for failing to implement multi-factor authentication or rotate credentials. The consensus: both are culpable, but the immediate responsibility sits with the companies running these devices.

AI-powered automation is changing the threat math

What makes FortiBleed notable isn't the technique. Credential stuffing is old. The scale is new. AI-driven automation tools now allow relatively unsophisticated actors to scan, test, and exploit at speeds that would have required significant infrastructure a few years ago.

The campaign represents a broader shift. Rather than hunting for zero-days, attackers are pivoting to mass automation against known weaknesses. A vulnerable firewall that's been sitting on the internet for three years with unchanged credentials is just as valuable as one with an unpatched bug. Often more valuable, because it's easier to exploit.

For defenders, this changes the priority stack. Patching still matters. But credential rotation, MFA enforcement, and network segmentation are now table stakes, not nice-to-haves.

What affected companies should do now

If you run Fortinet devices, the immediate actions are clear: rotate all credentials, enable multi-factor authentication on management interfaces, and check whether your devices are exposed to the public internet. If they are, move them behind a VPN or restrict access to known IP ranges.

Beyond immediate triage, organizations should assume any exposed Fortinet device may be compromised. Review logs for unusual traffic patterns. Check for new admin accounts or configuration changes. Consider engaging incident response specialists to determine if attackers have pivoted deeper into the network.

Frequently Asked Questions

What is the FortiBleed attack?

FortiBleed is an ongoing hacking campaign targeting Fortinet firewalls and VPNs. Attackers use automated tools to scan for exposed devices and break in using lists of previously leaked passwords, then harvest additional credentials from network traffic.

Which companies were affected by the Fortinet firewall hack?

According to Hudson Rock, affected companies include Accenture, Comcast, Foxconn, Lenovo, Oracle, Samsung, Siemens, and PwC. Government agencies in multiple countries have also been compromised.

Is FortiBleed exploiting a Fortinet vulnerability?

No. The attackers are using credential stuffing with leaked passwords, not exploiting a software vulnerability. The attack succeeds because organizations haven't changed default or compromised passwords.

How can I protect my Fortinet devices from FortiBleed?

Rotate all credentials immediately, enable multi-factor authentication, and ensure management interfaces aren't exposed to the public internet. Review logs for signs of compromise and consider engaging incident response if your devices were exposed.

How many Fortinet devices have been compromised?

Hudson Rock estimates over 73,000 unique Fortinet URLs have been hacked. SOCRadar puts the figure above 30,000. Devices in 194 countries have been affected.

Source: TechCrunch / Lorenzo Franceschi-Bicchierai