FortiBleed Credential‑Harvesting Campaign Compromises 86,644 Fortinet FortiGate Firewalls Worldwide

What happened

Attackers scanned the Internet for exposed FortiGate SSL‑VPN portals, then performed credential‑stuffing and GPU‑accelerated hash cracking to obtain clear‑text admin passwords. Compromised accounts were used to lock out legitimate admins, create new privileged accounts, and move laterally within victim networks.

Why it matters for trust and compliance

• The incident illustrates why continuous monitoring of privileged credentials and immutable logging of admin activity are essential control objectives for audit readiness across multiple frameworks.
• Demonstrates the need for real‑time privileged‑access monitoring and evidence collection.
• Supports audit readiness by proving that credential‑rotation and MFA policies are enforced.

Who is affected

Recommended actions

1. Rotate all FortiGate admin passwords and enable multi‑factor authentication.
2. Implement continuous monitoring of privileged logins and generate immutable audit logs.
3. Disable unnecessary SSL‑VPN portals and enforce strong cipher suites.
4. Conduct a credential‑reuse audit across all critical infrastructure devices.