A researcher found an exposed server holding real admin logins for tens of thousands of corporate firewalls, sitting there for anyone to grab. That leak, now called FortiBleed, has just been traced to two ransomware operations that share the same core crew.
Once again, the victims are companies running Fortinet FortiGate firewalls and SSL VPN gateways, not people using a consumer VPN app. But the campaign is a useful case study in exactly how attackers turn old, unpatched bugs into industrial-scale credential theft.
What FortiBleed actually is
In June 2026, security researcher Bob Diachenko discovered an unsecured database containing what looked like valid FortiGate credentials: usernames, email addresses, and plaintext passwords. BleepingComputer reported the initial count at 73,932 device URLs. Cybersecurity researcher Kevin Beaumont independently reviewed a sample of the data and confirmed some of the logins were genuine.
By June 19, the confirmed device count had climbed to roughly 86,644 across 194 countries, close to half of every internet-facing FortiGate appliance on the planet. Named victims in the dataset reportedly included Chevron, Samsung, Foxconn, Toyota, and several other large enterprises.
The root cause traces back further than the leak itself. Much of the credential harvesting rides on CVE-2022-40684, a path traversal bug in FortiOS that Fortinet patched back in October 2022. Nearly four years later, a large share of the fleet still hadn’t applied it, which is exactly the gap the attackers exploited.
How the credentials were actually cracked
The scale of this campaign is what separates it from a routine leak. According to later technical breakdowns, the operators scanned roughly 59.3 million internet-facing hosts looking for exposed FortiGate management panels, then ran 1.16 billion credential-based login attempts against 320,777 identified FortiGate targets.
Where straightforward credential stuffing didn’t work, they took a more patient route. FortiGate’s SSL VPN handshake can leak authentication hashes without a successful login. The attackers intercepted those hashes and fed them into a 45-GPU cluster managed through Hashtopolis, an open-source distributed password-cracking framework, to recover the plaintext passwords offline. That’s not a lone hacker with a laptop. That’s an industrial operation built specifically to turn “we couldn’t log in” into “we don’t need to.”
The Lynx and INC ransomware connection
The link that makes FortiBleed matter beyond one leaked database came in early July, when BleepingComputer reported that researchers had tied the credential-theft infrastructure to the Lynx ransomware operation. Threat intelligence firm SOCRadar went further, attributing the campaign directly to members of both the INC and Lynx ransomware-as-a-service groups, after finding that the same operators had access to negotiation panels used by both gangs.
That overlap isn’t a coincidence. Lynx emerged in mid-2024 and is widely believed by researchers to be a rebrand of the INC ransomware gang rather than a genuinely new crew. The Hacker News covered how the group deployed a custom packet-sniffing tool, dubbed “FortiGate Sniffer,” directly on compromised firewalls to intercept VPN and administrative credentials from live network traffic, on top of the cracked hashes.
By the time follow-up reporting landed, the numbers had grown again. Tech Times reported that the operation’s real footprint reached more than 430,000 FortiGate devices worldwide, with traffic-sniffing tools planted on around 19,000 of them, and evidence pointing to a team of roughly 20 people running the whole thing with defined roles. This wasn’t one credential dump. It looks like the front end of a ransomware supply chain: harvest access at scale first, decide who’s worth ransoming later.
What CISA is telling organizations to do
CISA’s June 18 alert tells any organization running FortiGate appliances or SSL VPN gateways to treat this as urgent, not routine. The core guidance:
- Terminate all active SSL VPN and administrative sessions immediately
- Reset every Fortinet VPN and administrative password, prioritizing internet-facing systems
- Enforce multi-factor authentication on all administrator and VPN user accounts
- Confirm devices use PBKDF2 for storing admin credentials and remove weaker legacy hash algorithms
- Upgrade to the latest FortiGate firmware
- Review logs for unexpected administrator access, unfamiliar accounts, or configuration changes nobody remembers making
None of that is exotic. It’s the same checklist that follows every one of these incidents, and the same one organizations skip until a breach forces the issue.
Corporate VPN gateway, consumer VPN app: still not the same thing
We made this point when a Check Point VPN zero-day got tied to the Qilin ransomware gang back in June, and it applies here too. A FortiGate SSL VPN is a corporate remote-access gateway. It accepts inbound connections from employees and sits directly in front of a company network, which is exactly why cracking its credentials is worth building a 45-GPU cluster for.
A consumer VPN app works the other way. You connect outbound to a provider’s server to encrypt your own traffic, and there’s no company network behind it for anyone to ransom. FortiBleed doesn’t say anything about whether NordVPN, Proton VPN, or any other consumer service is safe to use. Different product, different threat model, same three letters.
What this means if you’re just a consumer VPN user
If you’ve never touched a FortiGate appliance, the direct exposure here is zero. But the pattern is worth internalizing: SSL VPN protocols on aging firmware are a magnet for this kind of attack, because they were never built to withstand a billion-attempt cracking run pointed at them. On the consumer side, the equivalent mistake is sticking with an outdated protocol like PPTP or L2TP long after better options exist. If your provider still defaults to those, that’s a red flag worth acting on.
Modern protocols like WireGuard sidestep a lot of this by design: smaller attack surface, modern cryptography, no decades-old handshake quirks to exploit. Our WireGuard vs OpenVPN breakdown covers which protocol to pick and why it matters more than most people assume. A provider like NordVPN defaults to NordLynx, its own WireGuard implementation, which is the kind of default that ages well.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
The pattern keeps repeating
Fortinet appliances have produced a steady stream of exploited CVEs for years. Ivanti Connect Secure had its own zero-day wave. Pulse Secure and Citrix each had their turn before that. Edge devices sit on the internet by definition, they hold the keys to everything behind them, and patching them requires a maintenance window nobody wants to schedule. That combination is why they keep showing up in ransomware timelines, and why a four-year-old CVE like CVE-2022-40684 can still be doing damage in 2026.
The uncomfortable truth is that FortiBleed wasn’t a zero-day. It was a known, patched bug that a huge share of the internet’s firewall fleet never got around to fixing, sitting there long enough for someone to build industrial cracking infrastructure around it.
FortiBleed is less a single incident than a supply chain: harvest credentials at scale first, hand them to ransomware crews second. The 45-GPU cracking cluster and the 430,000-device footprint show how much infrastructure attackers will build around a single unpatched vulnerability once it's proven profitable. If you run FortiGate appliances, CISA's checklist is not optional. If you're a consumer VPN user, this story doesn't touch you directly, but it's another data point for the same rule: outdated protocols left running are exactly what turns a patched CVE into a years-long breach.
Sources: BleepingComputer on the initial leak | CISA hardening advisory | BleepingComputer on the Lynx ransomware link | The Hacker News on the INC and Lynx attribution | Tech Times on the 430,000-device scope