SonicWall says MySonicWall backup breach affects all customers

SonicWall disclosed on Wednesday that an unauthorized actor accessed firewall configuration backup files stored in its MySonicWall cloud backup service, affecting all customers who have used that feature. The company said suspicious activity was first detected in early September and publicly disclosed an incident on September 17; an investigation completed with assistance from Mandiant concluded on October 8 that threat actors had obtained backup files for every firewall that had been configured to use the cloud backup service.

According to SonicWall, the accessed files include encrypted credentials and configuration data. "The files contain encrypted credentials and configuration data while encryption remains in place, possession of these files could increase the risk of targeted attacks," the company said. SonicWall and Mandiant said the intruders gained access by mounting brute force attacks against the cloud backup API, then used the API to download stored preference files.

SonicWall initially reported that fewer than 5 percent of its firewall install base had been affected, but updated its assessment after the investigation to say that all customers who ever stored backups...