FortiBleed: leaked dataset exposes VPN credentials for ~74,000 Fortinet firewalls

On 17 June 2026, security researcher Bob Diachenko disclosed a leaked dataset — dubbed FortiBleed — exposing what appear to be valid Fortinet FortiGate VPN credentials, including usernames, email addresses, and plaintext passwords, for 73,932 firewall URLs spread across 194 countries and 21,632 unique domains. The exposed organisations reportedly include major global enterprises such as Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, and State Grid.

Not a new vulnerability

Crucially, FortiBleed is not the exploitation of an unknown Fortinet flaw. Fortinet said its investigation indicates the credentials were obtained through previous incidents and brute-force attacks and are not linked to any newly disclosed vulnerability, breach, or security advisory. The campaign instead leans on a far more basic failure: organisations that never rotated credentials after earlier compromises, leaving passwords that have since circulated in infostealer logs and breach databases still valid on internet-exposed firewalls.

A multi-operator, internet-scale campaign

The leak is the visible output of a broader operation attributed to a multi-operator, Russian-speaking cybercriminal group. Rather than simple credential stuffing, the operators systematically scanned the internet for exposed Fortinet instances and tested them against historical credential databases. Telemetry tied to the campaign points to an estimated 1.16 billion credential-based attempts against more than 320,000 FortiGate targets, alongside a parallel 2.1 billion brute-force attempts against more than 160,000 MSSQL servers — collectively yielding the 21,632 compromised domains.

Why it matters

FortiBleed is a stark illustration that credential hygiene, not just patching, is load-bearing for perimeter security. Valid VPN logins on a firewall hand attackers a clean, authenticated foothold inside an enterprise — no exploit required — and the dataset's reach across nearly 200 countries and tens of thousands of organisations makes it a ready-made target list. Defenders running FortiGate appliances were urged to rotate all VPN and administrative credentials, enforce multi-factor authentication, and assume that any password reused from a prior breach or harvested by infostealer malware is already in attacker hands.