Cybersecurity: a massive leak of Fortinet credentials exposes thousands of devices around the world

Critical security alert highlights major data breach affecting Fortinet and FortiGate devices used in many public and private organizations. According to the bulletin published on June 19, 2026 by the National Information System Security Agency ANSSI, this leak, called “FortiBleed”, could have significant consequences on the security of digital infrastructures on a global scale.

According to the analyzes cited in the document, notably those of cybersecurity researcher Bob Diachenko and the company Hudson Rock, nearly 75,000 FortiGate firewalls are believed to have been compromised. More than 21,000 unique domains are believed to be affected, while 73,932 exposed device URLs have been identified in 194 countries.

The leaked data reportedly includes VPN credentials, email addresses, and plaintext or decrypted passwords. This situation would encourage attempts at identity theft and unauthorized access to computer systems.

The bulletin also describes a large-scale attack campaign, marked by approximately 1.16 billion attempts targeting FortiGate equipment and nearly 2.1 billion attempts targeting Microsoft SQL servers. Experts believe that stolen or decrypted VPN credentials could be used to access administrative interfaces and internal networks of affected organizations.

The risks identified are multiple: compromise of VPN access, takeover of network equipment, lateral movement within information systems, exfiltration of sensitive data, installation of persistent backdoors and compromise of administrator accounts.

Critical infrastructure, public administrations, banks, insurance companies as well as the industrial, telecommunications and transport sectors are among the potentially most exposed areas.

Faced with this threat, ANSSI recommends that organizations using Fortinet solutions:“immediately reset VPN credentials and administrator accounts, force disconnection of active sessions, and, where possible, temporarily limit non-essential VPN access.”

The organization also recommends strengthening security measures by activating multi-factor authentication (MFA), updating FortiOS firmware and restricting administrative access to authorized IP addresses only. Increased monitoring of activity logs is also recommended to detect possible suspicious connections or unauthorized modifications.

According to ANSSI, the combination of exposed credentials, advanced decryption techniques and automated attacks suggests a structured and persistent campaign to exploit VPN access, requiring an immediate response from the organizations concerned.