TECHNOLOGY

United States warns of massive Fortinet credential breach

PUBLISHED Jun 19, 2026, 11:44 AM ET

Read, Watch or Listen

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory after researchers uncovered a large-scale credential theft campaign targeting Fortinet firewalls and VPN appliances, dubbed "FortiBleed." According to data from cybersecurity firm SOCRadar, administrative credentials for at least 86,644 internet-facing Fortinet devices have been compromised worldwide, impacting roughly half of all accessible units. Attackers are using automated tools to spray known username and password combinations, then monitoring network traffic to harvest further credentials and move into internal Active Directory environments. Telecom, government and education sectors are among the hardest hit, with the United States heavily affected. CISA urges immediate credential rotation, renaming of default accounts and rigorous traffic auditing.

By Michael Grant | JQJO News

Timeline of Events

Earlier this year, Fortinet devices heavily scanned
Recent weeks, bespoke credential spraying tool deployed
Recent weeks, over 86,000 Fortinet devices compromised
Recent weeks, attackers pivot into Active Directory
Recently, SOCRadar confirms large-scale credential theft
Today, CISA issues urgent FortiBleed advisory
Today, organizations urged to rotate credentials
Today, telecom, government, education sectors highlighted

News Intelligence

Your online safety is at risk. The FortiBleed breach affects thousands of internet-facing devices. If you use Fortinet firewalls or VPNs, your credentials may be compromised. Especially if you're in telecom, government, or education sectors. Check your devices, change your passwords.