FortiBleed Attack Affects 73,000 Fortinet Devices Globally

Over 73,000 devices and at least 75,000 Fortinet firewalls were exposed due to the FortiBleed leak, affecting major companies worldwide. The attack was reported globally, spanning 194 countries. The number of compromised devices varies across different reports, but the attack's reach is significant.

A large-scale credential exposure campaign dubbed FortiBleed has surfaced VPN credentials for approximately 73,932 unique FTNT Fortinet firewall and SSL VPN device URLs spanning 194 countries. Researcher Bob Diachenko first surfaced the dataset, which was subsequently analyzed by Hudson Rock and SOCRadar. Reports from BleepingComputer, CyberSecurityNews, and The Register placed the number of affected firewall endpoints between 73,000 and 75,000, with more than 21,000 unique domains implicated.

Despite the alarming name, security analysts emphasize that FortiBleed does not involve a new zero-day vulnerability. The attackers, identified as a Russian-speaking multi-operator group, recycled credentials from earlier Fortinet breach dumps and infostealer malware databases, then tested them at scale against internet-exposed FortiGate devices. The operation also intercepted SSL VPN authentication hashes cracked offline using a 45-GPU Hashtopolis cluster. Investigators estimate the campaign executed roughly 1.16 billion credential-based attempts against over 320,000 FortiGate targets.

For Fortinet, the episode is a reputational challenge rather than a software flaw disclosure, but the distinction may matter little to enterprises scrambling to rotate credentials and audit access logs. Organizations using FortiGate appliances are advised to rotate all VPN credentials, enforce multi-factor authentication, and audit firewall access logs for anomalous authentication attempts. The incident reinforces a broader industry pattern: compromised credentials from old breaches remain one of the most effective and underestimated attack vectors in enterprise network security.