Some organisations have found themselves unable to log in to their own firewalls. The cause, according to a joint advisory from the FBI and the US Secret Service, is a campaign known as FortiBleed, which is still running months after it was first exposed.
The advisory, reported by BleepingComputer and Help Net Security, says the attackers target internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Those devices sit at the edge of a network and control who gets in.
How the attacks work
FortiBleed is not a software bug.
The Picus Security analysis notes it has no CVE and no patch to apply.
Instead, according to BleepingComputer’s account of the FBI warning, hackers get in with credentials that were previously leaked or taken from infostealer logs, credential stuffing and password spraying.
Once inside, they pull more authentication data from the device. BleepingComputer reports they then use a distributed GPU cluster running Hashcat and Hashtopolis to crack the stolen password hashes offline.
The FBI says that in some cases the attacker creates new administrator accounts. Those accounts are then used to delete the existing admins or change their passwords. After that, the attacker tries to establish persistence and move through the victim’s network.
How it came to light
The campaign became public in June. Per BleepingComputer, the attackers accidentally exposed a backend server. It held a directory of tools and datasets, including usernames and plaintext passwords tied to 73,932 firewall URLs in 194 countries. Picus Security credits researcher Volodymyr “Bob” Diachenko with first flagging the exposed directory on 13 June 2026.
The scale of the damage depends on who is counting. CISA cited about 74,000 Fortinet devices in a 18 June alert, according to Hoodline. SOCRadar later verified 86,644 working device credentials, and the FBI and Secret Service advisory cites that figure, per Help Net Security.
A larger number has also circulated. CyberSecurityNews reported that more than 430,000 FortiGate firewalls were compromised and over 110 million credentials harvested from live traffic since at least February 2026, using a built-in FortiOS diagnostic command. That figure is far above the others, and the sources reviewed here do not reconcile it with the 86,644 count. Treat the exact total as unsettled.
What administrators should do
The sources describe the attack, and they do not give a single official checklist. The steps below follow directly from the methods they describe.
- Check for lockouts and unknown accounts. Review the administrator list on every FortiGate for accounts you did not create, and look for recent password changes.
- Reset credentials. Assume any password used on an exposed device, or reused elsewhere, may be in a leaked dataset. Change them, starting with admin and VPN accounts.
- Turn on multi-factor authentication for administrators and VPN users, so a cracked password alone is not enough.
- Limit exposure. Do not leave management interfaces open to the whole internet where it can be avoided.
- Look for signs of spread. If an unauthorised admin turns up, treat the network as potentially breached, not just the firewall.
- Check the SOCRadar lookup. The firm has offered a way to check whether a device appears in the leak.
What ordinary users can take from it
Most readers do not run a FortiGate. But many connect to work through one, and the same weakness applies to anyone. Reused passwords and infostealer malware feed this kind of attack.
Use a unique password for every account, ideally from a password manager. Turn on app-based or hardware two-factor login for work and personal accounts. If your employer asks you to reset a VPN password, do it. If you did not expect the request, confirm it through a known contact first.
The FBI says the attacks are ongoing. Fortinet’s own response is not covered in the sources reviewed here.