FortiBleed: 86,000 Fortinet Firewall Credentials Stolen and Circulating Now

If you run a Fortinet firewall or VPN gateway, stop reading after this sentence and go check your devices. A credential theft campaign called FortiBleed has produced a verified database of over 86,000 confirmed working usernames and passwords harvested from internet-facing Fortinet infrastructure across 194 countries. Roughly half of all publicly accessible Fortinet firewalls worldwide may be affected. CISA and the UK's NCSC have both issued urgent guidance. The scary part: strong passwords didn't help. Attackers pulled credentials directly from infostealer logs, meaning complex passwords that had been previously stolen were already in the database in plaintext. This isn't a vulnerability you patch. It's a credential problem. What to do right now: terminate all active SSL VPN and administrative sessions, reset every Fortinet VPN and admin password, check Hudson Rock's or SOCRadar's free FortiBleed lookup tools to see if your devices are listed, enable phishing-resistant MFA on all Fortinet management and VPN interfaces, and audit your logs for unauthorized account creation or unexpected config changes. If you find evidence of compromise, changing passwords alone is not enough — you may need a factory reset and a full investigation.