A widespread hacking campaign has compromised tens of thousands of Fortinet firewalls and VPN appliances used by major global enterprises, with cybersecurity firms identifying more than 73,000 compromised devices in an ongoing operation researchers are calling FortiBleed. Unlike many previous attacks against Fortinet equipment, this campaign does not exploit unknown vulnerabilities. Instead, attackers are using leaked and previously known passwords to breach devices that have not had their default or reused credentials changed, highlighting a fundamental security gap in enterprise network perimeter management.
How the FortiBleed Attack Operates at Scale
The attackers first deploy automated scanners that systematically search the internet for exposed Fortinet firewalls and VPN gateways. Once a target is identified, the hackers attempt to authenticate using credential lists sourced from prior data breaches and password leaks. When a compromised device is accessed, it is repurposed as a listening post that monitors all traffic passing through the firewall. Any additional credentials observed in transit are harvested and fed back into the scanning infrastructure, creating a self-sustaining cycle of compromise. SOCRadar described this mechanism as a self-feeding system in which freshly collected passwords are continuously cycled back to breach further devices.
Scope and Scale of the FortiBleed Compromise
Hudson Rock reported evidence indicating that more than 73,000 unique Fortinet URLs have been hacked, while SOCRadar placed the total at over 30,000 compromised devices. The discrepancy reflects differences in how each firm counts affected endpoints, but both assessments confirm a large-scale operational compromise affecting organizations across multiple sectors and geographies. The countries with the highest concentration of breached devices are India, the United States, Taiwan, and Mexico, though victims are distributed globally. The most affected industries include IT services, construction materials, and telecommunications, with government agencies also among those hit.
Among the named organizations whose devices appear in the compromised credential data are Accenture, Comcast, Foxconn, Lenovo, Oracle, Samsung, Siemens, and PwC. A Lenovo spokesperson acknowledged receipt of a request for comment but did not respond. The other companies did not provide comment.
Is the FortiBleed Attack Exploiting a New Vulnerability?
No. FortiBleed does not rely on any unknown vulnerability, zero-day exploit, or unpatched software flaw. The attack method is credential-based: attackers use previously stolen or leaked passwords to gain administrative access to exposed Fortinet devices. This distinction is critical for organizations assessing their risk. Patching alone will not remediate the exposure if weak, reused, or publicly known passwords remain in use on internet-facing interfaces. The attack succeeds because organizations have not disabled default credentials, rotated exposed passwords, or implemented basic authentication hardening on perimeter devices.
Fortinet’s Response and the Credential Data
Fortinet spokesperson Tiffany Curci stated that the company is aware of the reported credential-harvesting campaign targeting its firewalls and VPN gateways. Fortinet’s analysis indicates that the data involved is a resharing of credentials from previous incidents combined with brute-forcing of active passwords, and is not linked to any recent vulnerability advisory or newly disclosed incident. Independent security researcher Kevin Beaumont analyzed the credential data and confirmed its legitimacy in a blog post published this week. The campaign was first flagged by security researcher Bob Diachenko over the weekend before the two cybersecurity firms published their detailed reports.
Russian-Linked Threat Actor and Broader Implications
Both Hudson Rock and SOCRadar assess that the group behind the FortiBleed campaign appears to be Russian-speaking. The operation represents a shift in tactics from the vulnerability-based attacks that have historically defined Fortinet breaches. In the past three years, multiple hacking campaigns have exploited actual flaws in Fortinet firmware to deploy ransomware or steal data. This campaign instead relies on the failure of enterprises to enforce basic password hygiene on exposed devices, making it less technically sophisticated but no less dangerous.
What Affected Users and Organizations Should Do Now
Any organization using Fortinet firewalls or VPN gateways should take immediate action. First, audit all internet-facing Fortinet interfaces and disable remote administration or VPN access on any device that does not require it. Second, change every administrative and user password associated with the device immediately, ensuring that no credential matches any password found in previous data breaches. Use a zero-knowledge password manager or an end-to-end encrypted credentials vault to generate and store unique, complex passwords for each administrative account. Third, enable multi-factor authentication on all Fortinet management interfaces and VPN portals without exception. Fourth, review firewall logs for signs of unauthorized access, particularly any administrative logins from unfamiliar IP ranges. Finally, organizations should monitor credential lists circulating in underground forums and consider deploying a credential monitoring service for corporate accounts. For individual users whose employer uses Fortinet VPNs, the most protective step is to change personal passwords used on company systems and enable multi-factor authentication on any account that supports it. The FortiBleed campaign demonstrates that sophisticated cyberattacks do not require novel exploits when basic security fundamentals are left unenforced.
