15,000 FortiGate Configs and VPN Credentials Leaked

A massive security breach has exposed sensitive data from over 15,000 FortiGate firewall devices. Hackers from the newly emerged “Belsen Group” leaked configuration files, IP addresses, and VPN credentials on the dark web, making the information freely available to other cybercriminals.

According to BleepingComputer, the leak includes plain text passwords, private keys, and firewall rules, offering attackers a detailed view of affected organizations’ network defenses. According to cybersecurity researcher Kevin Beaumont, the leaked data appears to have been collected in October 2022 through the exploitation of CVE-2022-40684, a zero-day vulnerability in Fortinet firewalls. Fortinet had disclosed the flaw in 2022 and warned customers to patch their systems immediately as they had observed active exploitation.

Beaumont confirmed the data’s authenticity by matching leaked serial numbers to exposed devices visible on the Shodan search engine. Despite being over two years old, he emphasized that the information still poses significant risks as many affected devices remain operational and accessible.

The Belsen Group announced the leak on January 14, 2025, describing it as their “first official operation.” The leak is likely opportunistic rather than targeted, affecting both private and governmental organizations.

The group claimed that their operation was designed to establish their name in the cybercrime world, signaling potential future activities. Experts have linked this incident to broader security concerns surrounding Fortinet devices. In a related campaign, researchers at Arctic Wolf observed attackers exploiting another vulnerability, CVE-2024-55591, in FortiGate firewalls.

This newer flaw has been actively exploited since November 2024, further compounding risks for organizations relying on the technology. A blog post by Arctic Wolf detailed how attackers gained unauthorized access to firewall interfaces, altered configurations, and escalated their access.

Fortinet hasn’t specified the number of customers affected but has urged organizations to perform immediate updates to all vulnerable devices. Experts recommend restricting public access to management interfaces and enabling detailed logging tools to identify malicious activity early.