# Massive Firewall Credential Leak Exposes Tens of Thousands of Organisations Worldwide > A massive credential leak has exposed roughly 74, 000 Fortinet firewall devices across nearly 200 countries, here is what businesses need to do now to stay protected. Source: https://loopbackup.com/blog/massive-fortinet-firewall-credential-leak-2026 Publisher: Loop Backup Content language: en --- A newly uncovered cybersecurity incident has revealed one of the largest known collections of compromised enterprise firewall credentials, putting organisations across almost every industry at risk. Security researchers have discovered that attackers successfully gathered login credentials from tens of thousands of internet-facing Fortinet firewall devices, providing potential access to corporate networks belonging to major global organisations. Companies reportedly affected include technology vendors, logistics providers, manufacturing firms, financial organisations, government agencies and defence contractors. ## How the Attack Worked Rather than exploiting a single software vulnerability, the attackers focused on internet-exposed VPN and remote access services. Using highly automated infrastructure, they scanned the internet for Fortinet remote access portals before launching large-scale password attacks against hundreds of thousands of systems. Once valid credentials were identified, attackers could establish trusted access into corporate networks. Researchers believe the attackers then attempted to move deeper into affected environments by targeting authentication services such as Microsoft Active Directory and RADIUS servers. This allowed them to expand their access beyond the original firewall and potentially reach critical business systems. ## Password Cracking at an Industrial Scale One of the most concerning aspects of the operation was the computing power involved. Investigators found evidence that the attackers operated a dedicated GPU cluster specifically designed to crack captured authentication hashes. Instead of relying on simple password lists, the system continuously learned from previously cracked passwords, generating increasingly accurate password combinations as the attack progressed. This adaptive approach significantly increased the success rate compared to traditional password attacks. ## Organisations Around the World Impacted Researchers estimate that approximately **74, 000 Fortinet devices** across more than **21, 000 public IP addresses** were compromised. The affected organisations span nearly **200 countries** and include businesses in sectors such as: - Information Technology - Telecommunications - Financial Services - Manufacturing - Construction - Engineering - Government - Defence - Critical Infrastructure Several multinational organisations have reportedly appeared within the leaked dataset, highlighting the global scale of the campaign. ## Why Firewalls Are a Prime Target Enterprise firewalls often provide secure remote access for employees, contractors and administrators. Because these devices sit at the edge of an organisation's network, successfully compromising them can give attackers a direct pathway into internal systems without needing to bypass additional security controls. For this reason, firewall appliances continue to be one of the most attractive targets for cybercriminals and state-sponsored threat actors. ## What Businesses Should Do Immediately Any organisation using Fortinet remote access should treat this incident seriously. Recommended actions include: - Reset all VPN and administrator passwords. - Enforce Multi-Factor Authentication (MFA) on every remote access account. - Review firewall and VPN authentication logs for unusual login activity. - Audit Active Directory and privileged accounts for unexpected changes. - Ensure Fortinet appliances are fully updated with the latest security patches. - Remove unnecessary internet-facing management interfaces. - Monitor for suspicious lateral movement within the network. Even organisations that have not experienced a confirmed compromise should assume exposed credentials may eventually be used in future attacks. ## Why Independent Backups Matter Incidents like this demonstrate that perimeter security alone cannot guarantee protection. If attackers gain administrative access, they may encrypt data, delete cloud content, disable security controls or compromise Microsoft 365 and other SaaS platforms. Maintaining an independent, immutable backup ensures critical business data can still be recovered, even if production systems or administrator accounts are compromised. Cybersecurity is no longer just about preventing attacks. It is equally about ensuring your organisation can recover quickly when they occur. ## Protect Your Business with Loop Backup Loop Backup provides immutable, independent cloud backup that stays safe even when attackers breach your perimeter, explore [enterprise cloud backup](/cloud-backup-enterprise) for resilient, air-gapped protection, or see how our [ransomware sync protection](/ransomware-sync-protection) keeps your Microsoft 365 and Google Workspace data recoverable after an attack.