FortiBleed hack compromises 30,000+ Fortinet devices globally

A massive, ongoing hacking campaign has compromised tens of thousands of Fortinet firewalls and VPN gateways used by major corporations and government agencies worldwide. Security researchers, who have dubbed the operation "FortiBleed," report that attackers have gained verified access to more than 30,000 devices across nearly 200 countries, creating a critical threat to global network security.

The campaign was first uncovered over the weekend of June 13-14, 2026, by security researcher Bob Diachenko, who discovered an exposed attacker server containing a vast database of credentials. Subsequent analyses by firms including Hudson Rock and SOCRadar, published this week, confirmed the scale and method of the attack. Unlike previous campaigns that exploited software vulnerabilities in Fortinet devices, this operation relies on credential harvesting and reuse. Attackers are using automated tools to scan the internet for exposed Fortinet management and VPN interfaces, then attempting to log in using lists of previously leaked or default passwords.

Once inside a device, the attackers use it as a listening post to monitor network traffic and steal additional credentials. These newly...