Your Firewall's Old Passwords Are Probably Already for Sale

Imagine a locksmith quietly copying your front-door key, then selling it to a burglary crew. That is roughly what has been happening to tens of thousands of businesses that run a Fortinet FortiGate firewall or virtual private network (VPN) gateway — and last week the U.S. federal government said publicly that the problem is still very much active.

What Just Happened

The U.S. Federal Bureau of Investigation (FBI) and the U.S. Secret Service issued a joint cybersecurity advisory warning about a credential-theft operation that researchers are calling FortiBleed. FortiBleed is a credential-theft campaign that has compromised more than 86,000 Fortinet FortiGate firewalls and VPN gateways across 194 countries by exploiting previously stolen credentials to establish persistent access.

The phrase "persistent access" matters. It means attackers are not just walking through a door and leaving. Affected organizations may find themselves locked out of their own systems if threat actors disable accounts or change passwords — a problem that requires remediation steps beyond standard patching and password resets.

And it gets more direct than that. According to the FBI advisory, attackers packaged the compromised VPN configurations and validated access for resale to other threat actors — including ransomware affiliates associated with INC/Lynx and Payload ransomware.

How the Criminal Assembly Line Works

FortiBleed is a useful window into how modern ransomware attacks are actually organized, because they are rarely carried out by a single group from start to finish. This arrangement allows different criminal groups to specialize in separate stages of an intrusion: one group focuses on identifying exposed systems, collecting credentials, and confirming access, while other groups can then acquire that access and use it to conduct additional attacks, including ransomware deployment.

An internal tracking file uncovered by researchers found more than 20 affiliates in defined roles scanning thousands of FortiGate portals across more than 150 countries. At least 12 organizations were breached and encrypted with ransomware.

The ransomware groups receiving this purchased access — INC, Lynx, and Payload — are not new, but they are active and deliberately targeting businesses of every size. Lynx's most frequently targeted industry is industrials and manufacturing, with its primary victim region being North America. That puts a lot of small and mid-size manufacturers, distributors, and contractors squarely in the crosshairs.

Why This Particular Warning Is Worth Your Attention

Fortinet FortiGate appliances are not exotic enterprise-only hardware. They are popular precisely because they are affordable, capable, and widely sold through managed service providers (MSPs) to small and mid-size businesses. If your office has a firewall sitting in a rack or a closet, there is a reasonable chance it carries the Fortinet name.

What makes FortiBleed especially uncomfortable is the timeline. Cybersecurity experts have warned for months about the FortiBleed campaign. A detailed study published in July found affiliates of the INC and Lynx groups actively participating in the operation. The FBI and Secret Service weighing in now means the problem has not gone away — it has grown.

This also fits a broader pattern confirmed this week by Check Point Research: Check Point Research reported a 48% year-over-year increase in global cyberattacks during September 2026, with reported ransomware attacks up 53%. The numbers are not incidental background noise. They describe the environment your firewall is sitting in right now.

The Honest Severity Read

Not every Fortinet device in the world is compromised. The FortiBleed campaign targets specific firmware versions with known vulnerabilities, and organizations that have kept their devices current and rotated credentials after any past advisories are in a meaningfully better position. This is not a reason to panic; it is a reason to verify.

The real risk for small businesses is organizational inertia: the firewall gets installed, the installer sets a password, and no one touches it again for two or three years. For security teams — and this includes your IT provider — the concern is not limited to detecting a single unauthorized login. It includes understanding whether exposed credentials have enabled additional accounts, persistent access, or activity elsewhere in the network.

In plain language: if an attacker got in six months ago, patching today does not necessarily kick them out. They may have already created backdoors, added accounts, or sold a copy of your access to someone who has not used it yet.

What This Means for Your Business

You do not need to understand the technical specifics of how FortiBleed works. What you need is an honest answer from whoever manages your network about whether your devices are affected and whether your credentials have been audited. The FBI advisory is a legitimate forcing function for that conversation.

Here are the specific questions to bring to your IT provider or managed service provider this week:

• "Do we use Fortinet FortiGate devices, and are they fully up to date on firmware?" Firmware updates for network appliances often get deprioritized compared to server patches. Find out when the last update was applied.
• "Have the admin credentials on our firewall and VPN been changed in the last six months?" If anyone has ever had administrative access who no longer works for you — an old IT contractor, a former employee — those credentials need to be rotated now.
• "Has anyone reviewed the admin accounts on our network devices to confirm there are no accounts that shouldn't be there?" This is a basic but often skipped step. Attackers frequently create secondary accounts to maintain access even after passwords are changed.
• "Are we getting alerts if someone logs into our firewall or VPN from an unusual location or at an unusual hour?" Visibility is everything. If no one is watching, no one will notice a quiet intrusion.
• "If our firewall credentials were compromised six months ago and we didn't know it, what would we see differently today?" This forces a real conversation about your current detection capabilities — not your theoretical ones.

One Decision to Make Before Friday

If you cannot get a confident, specific answer to all five of those questions within 48 hours, that itself is information. A managed service provider who supports your network should be able to confirm firmware currency and credential hygiene without needing to schedule a meeting about it. If yours cannot, a brief external review of your network devices is worth the cost — which is, by any measure, considerably less than a ransomware recovery.

Coalition's 2026 Cyber Claims Report recorded initial ransom demands up 47% to an average of more than US $1 million across its policyholders. Your FortiGate appliance almost certainly cost less than $2,000. The math is not complicated.