FortiBleed leak exposes Fortinet VPN logins: check yours now

A newly uncovered data leak dubbed "FortiBleed" has exposed working VPN and admin credentials for roughly 75,000 Fortinet FortiGate firewalls around the world, as reported by BleepingComputer. Security researchers who reviewed the data confirmed that many of the usernames and passwords are genuine, and that most of the affected firewalls are still online. The credentials appear to have come from exported FortiGate configuration files and include usernames, email addresses and plaintext passwords.

Why This Matters for Australian Businesses

FortiGate firewalls sit right at the edge of the network in a huge number of Australian businesses. They're the front door, and everything else sits behind them. If your firewall's credentials are in this dump, an attacker can log in over SSL VPN and walk straight into your network, then move sideways to your servers, files and Microsoft 365.

What to Do Right Now

Check whether your firewall appears in the leak. Hudson Rock has published a free FortiBleed lookup tool. Whether you're affected or simply not sure, take these steps immediately:

• Rotate every VPN and admin password on your FortiGate now
• Enforce multi-factor authentication on all VPN accounts
• Get the firewall's management interface off the public internet
• Review your VPN logs for any logins you don't recognise