Fortinet admits hackers steal 440GB of customers’ cloud data

• Breach was publicly detailed by “Fortibitch” on a hacking forum, where the threat actor publicised their claim to have stolen data and shared credentials linking to an alleged storage location for this information.
• Company says the incident impacted less than 0.3% of its customer base and did not lead to any malicious activity targeting customers.
• Firm emphasised that there has been no evidence of data encryption or ransomware involvement, nor was there unauthorised access to Fortinet’s corporate network.

Company has maintained that its core operations, products, and services remain unaffected by the breach.

The confirmation by cybersecurity giant Fortinet of a significant data breach has raised alarm bells within the cybersecurity community and among its customers.

The breach, allegedly perpetrated by a threat actor known as “Fortibitch,” involved the theft of approximately 440GB of files from Fortinet’s Microsoft SharePoint server.

The incident not only highlights the vulnerabilities that persist even within organisations dedicated to cybersecurity but also underscores the evolving tactics employed by cybercriminals in the digital landscape.

Fortinet is renowned for its comprehensive suite of cybersecurity products, including firewalls, routers, and VPN devices, as well as advanced solutions in Security Information and Event Management (SIEM), network management, and Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR).

Raises eyebrows

The company’s prominence in the cybersecurity sector renders the breach particularly concerning, as it raises questions about the efficacy of security protocols even among industry leaders.

The breach was publicly detailed by “Fortibitch” on a hacking forum, where the threat actor publicised their claim to have stolen data and shared credentials linking to an alleged storage location for this information.

While the breach reportedly affected customers primarily within the Asia-Pacific region, Fortinet’s acknowledgment of the incident alludes to a broader implication regarding the security of cloud-based storage solutions.

Fortinet confirmed that the unauthorised access originated from a “third-party cloud-based shared file drive,” resulting in the compromise of limited data associated with a small number of customers.

Related Posts:

• Hacker offers to sell database of Kuwait’s Boutiqaat
• Hackers target government agencies the most in first half of 2024
• Iran cyber army helps cybergangs deploy ransomware

Notably, the company stated that the incident impacted less than 0.3 per cent of its customer base and did not lead to any malicious activity targeting customers.

Fortinet’s public communications following the breach have sought to reassure stakeholders. The firm emphasised that there has been no evidence of data encryption or ransomware involvement, nor was there unauthorised access to Fortinet’s corporate network.

Zero-day vulnerabilities

Furthermore, the company has maintained that its core operations, products, and services remain unaffected by the breach. Fortinet’s prompt engagement with the affected customers and its ongoing monitoring of the situation reflect a commitment to transparency and customer safety, which is critical in maintaining trust in the cybersecurity field.

However, this incident represents a troubling trend in the cybersecurity landscape.

Fortinet is not unfamiliar with security incidents, having faced breaches in the past, including exploitation of vulnerabilities in its products by threat actors.

For instance, in May 2023, a breach involving the GitHub repositories of Panopta, a company acquired by Fortinet, resulted in the leak of sensitive data. Additionally, reports have highlighted previous exploits of zero-day vulnerabilities within Fortinet’s security solutions.

As cybercriminals continue to adapt and refine their tactics, it is crucial for organisations—even those operating in the cybersecurity sector—to enhance their defensive measures and remain vigilant against potential threats.