Cybercriminals allegedly hacked tens of thousands of Fortinet firewalls used by major companies all over the world

A significant cybersecurity breach has emerged, with reports indicating that tens of thousands of Fortinet firewalls and VPNs utilized by major corporations globally have been compromised. This extensive hacking operation, referred to as 'FortiBleed,' is reportedly not exploiting unknown vulnerabilities within the devices but rather taking advantage of basic security oversights by companies. The methodology of the attackers involves scanning the internet for exposed Fortinet systems. Once identified, they gain access using lists of previously leaked passwords, allowing them to infiltrate the devices. This breach not only enables the theft of sensitive data from affected companies but also allows hackers to monitor network traffic and collect additional credentials. Cybersecurity firms Hudson Rock and SOCRadar have provided alarming statistics, indicating that more than 73,000 unique Fortinet URLs have been compromised. SOCRadar further estimates that over 30,000 devices are currently under the control of the hackers. Notable companies among those affected include Accenture, Comcast, Foxconn, Lenovo, Oracle, Samsung, Siemens, and PwC, although responses from these firms have been minimal. The cybersecurity firms highlighted that the regions most impacted by this breach include India, the United States, Taiwan, and Mexico, though victims span across numerous countries. Industries particularly vulnerable to this attack include IT services, construction materials, and telecommunications, with government entities also being targeted. The hacking group behind this operation appears to operate in Russian-speaking regions, according to the reports from Hudson Rock and SOCRadar. The breach was initially alerted by security researcher Bob Diachenko, and independent analyst Kevin Beaumont has confirmed the authenticity of the data. Interestingly, while Fortinet devices have been previously targeted through vulnerabilities, this incident marks a shift towards exploiting leaked passwords—a less complex yet highly effective method of attack.