|
This is an exceptionally serious vulnerability that you need to know about NOW - It cannot wait for the usual Monday morning mail.
We have created a tool for you to upload your company names or domains to see if you are on the list.
BleepingComputer is reporting a newly discovered leak, dubbed “FortiBleed”, which appears to expose Fortinet and FortiGate VPN credentials for 73,932 firewall URLs across organisations worldwide.
The leaked data reportedly includes usernames, email addresses, and plaintext passwords, in other words, not just hashes that still need to be cracked, but credentials that may be directly usable.
This is not just another “some passwords leaked somewhere on the internet” story.
According to the reporting, the dataset spans 194 countries and 21,632 unique domains, affecting organisations across telecommunications, IT services, financial services, government, healthcare, education and manufacturing. Some of the names referenced in the dataset allegedly include major global brands and critical infrastructure operators.
Cybersecurity researcher Kevin Beaumont has independently reviewed parts of the data and says some of the admin logins and passwords are authentic. He also believes the data may have come from exported Fortinet configurations, because it contains information normally found in config files, not just login pages.
That is the really nasty bit, this may not simply be a brute-force password dump.
The exact cause is still unknown. It has not yet been confirmed whether the data was stolen through a Fortinet vulnerability, exposed management interfaces, stolen configuration files, credential harvesting, or some other method. Fortinet had not yet responded to BleepingComputer at the time of publication.
What should you do NOW?
Email us on: fortibleed@firsttech.ms
If you have Fortinet/FortiGate devices exposed to the internet, do not wait for a meeting, a committee, or "let's worry about it tomorrow".
- Rotate all Fortinet VPN and administrative passwords immediately.
- Enforce MFA on VPN and administrative access.
- Check whether FortiGate management interfaces are exposed directly to the internet.
- Review VPN, admin, firewall and authentication logs for suspicious activity.
- Check for unknown users, new accounts, changed policies, strange tunnels, odd login geographies and lateral movement.
- Patch FortiOS and Fortinet appliances to current supported versions.
- Assume any reused password is already a problem somewhere else as well.
This is a good moment to remember that VPN credentials are not “just another password”. They are often the front door to the network, and in many environments, once that door is open, the bad guys don’t need to be very clever anymore.
Dark and Deep web data should always be treated as indicative rather than definitive. By its nature, this information can be incomplete, unreliable, outdated, or intentionally misleading.
Any findings should therefore be regarded as Indicators of Compromise, not confirmed evidence. They are intended to highlight potential risk and guide further investigation.
A qualified analyst should always review and validate the information before any conclusions are drawn or action is taken..... hence CONTACT US!
Please contact your First Technology Group account manager to connect you with our security specialists to help assess Fortinet exposure, VPN hardening, credential rotation, MFA enforcement and log review.
And in this case also contact us directly on: fortibleed@firsttech.ms
And use this tool to check if you are "on the list": https://tools.bui.systems/fortibleed
| 
