SonicWall reports cloud backup breach affecting under 5% of customers

SonicWall confirmed this week that threat actors gained access to cloud-stored firewall backup files on its MySonicWall.com portal, exposing configuration data for fewer than five percent of the companys firewall install base and prompting a coordinated remediation push from the vendor and its customers. The company said its security teams detected suspicious activity, validated the intrusion over the past few days and blocked the attackers, and it published and updated an advisory on September 17 and 18 describing the incident.

SonicWall said the intruders used a series of account-by-account brute force attacks to obtain backup preference files. While passwords and some credentials in those files were encrypted, the company warned they also contained serial numbers, network rules and other configuration information that could make it easier for attackers to target affected devices in the future. SonicWall added it is not presently aware of any online leaks of the stolen files.

Bret Fitzgerald, SonicWalls senior director of global communications, said the investigation found that fewer than five percent of its firewall install base had backup preference files stored in the cloud...