Security experts discovered a vast collection of stolen Fortinet firewall credentials, laying bare login information belonging to thousands of organizations worldwide.

Known as FortiBleed, the collection holds clear-text usernames, emails and passwords tied to 73,932 distinct Fortinet FortiGate firewall and VPN appliances spanning 194 nations and more than 21,000 domains. Analysts believe the total represents about half of all Fortinet firewalls visible online.

Names listed in the records include major players such as Oracle, Chevron, Lenovo, FedEx, Foxconn, Samsung, Comcast, Siemens, PwC and Accenture, plus a NATO defense supplier. Fortinet itself reportedly appears on the roster, according to Ars Technica.

No novel exploit, only large-scale password attacks

A notable aspect of FortiBleed is the absence of any sophisticated new vulnerability in Fortinet products.

Attackers instead scanned publicly reachable Fortinet devices, tested batches of previously disclosed passwords and logged every successful entry.

They compensated for the lack of innovation through volume, probing hundreds of thousands of login points, capturing VPN hashes and cracking them via a 45-GPU rig that performed over a billion attempts. Researcher Bob Diachenko noted to Ars Technica that scale itself supplied the sophistication.

Once authenticated, the intruders turned each device into a monitoring station, capturing traffic and harvesting additional credentials in transit. The firewall, intended as a barrier, served instead as an observation post.

Diachenko, who located the data on the attackers server, links the operation to a Russian-speaking crew. SOCRadar and Hudson Rock examined the material, while Kevin Beaumont verified that the logins remain valid. The initial source of the credentials, possibly exported FortiGate configuration files, remains unknown.

Scope of impact

Exposed credentials do not automatically equal a full network intrusion. The records indicate which systems could be accessed rather than confirming that every listed organization suffered a breach.

Real harm has occurred nonetheless. Diachenko reports at least four entities were fully compromised, among them a Turkish NATO contractor that lost classified files.

Fortinet rejects the narrative, stating the material reflects recycled data from earlier events plus brute-force attempts and bears no connection to recent advisories. Researchers note the devices differ from those in a prior 2025 incident and many run up-to-date firmware, suggesting a fresh collection.

The episode fits a broader trend in which VPN and firewall appliances are repeatedly targeted, with groups such as Qilin using them for initial entry.

Remediation remains straightforward. Experts recommend changing FortiGate administrator and VPN passwords, enabling multi-factor authentication for remote access, restricting management interfaces to approved addresses, auditing logs for unusual activity and deleting unused accounts.

A single reused password can bypass even the strongest perimeter controls.