Breach report · Technology
Nearly 500,000 Fortinet VPN Accounts Leaked By Hackers
Hackers leaked login credentials for nearly 500,000 Fortinet VPN accounts; Fortinet warns unpatched or unreset credentials remain vulnerable.
Exploit: Hacking Company: Fortinet Industry: Technology, Network Security Solutions Provider Sources: https://www.bleepingcomputer.com/news/security/hackers-leak-passwords-for-500-000-fortinet-vpn-accounts/
It has been reported that almost 500,000 Fortinet VPN login names and passwords have been stolen after the data was recently leaked onto hacking forums. The threat actor that obtained the data claims the info was taken from exploitable devices last summer and although the vulnerability has been patched, many of the VPN credentials are still valid.
In a statement to address the issue, Fortinet confirmed, “While they may have since been patched, if the passwords were not reset, they remain vulnerable.”
What makes this incident significant is that if left unchanged, the VPN credentials could potentially allow anyone in their possession network access to install malware, deploy ransomware, or execute further data exfiltration.
Next Steps For Fortinet Server Admins
As the data has been leaked onto multiple data leak sites, it is advisable for any administrators of Fortinet VPN servers to assume the compromised credentials are valid and act accordingly.
- Perform a forced reset of all user passwords
- Check your logs for possible intrusions or other suspicious activity
- Ensure the latest patches have been installed
- Update your Incident Response plan
If you would like to check the list of known devices compromised that were compromised, click here for cyber security researcher, Cypher’s, list of the leaked device’s IP addressees.