What We Know
Multiple security vendors and reporting label an active campaign "FortiBleed" that has harvested credentials from internet-facing Fortinet FortiGate VPN/firewall devices. Recorded Future's Insikt Group reported 73,932 affected systems; other outlets and researchers describe the scale as about 73,000–75,000 FortiGate systems worldwide. CSO Online says researchers found exposed credentials across many countries (reporting cites 194 countries). Fortinet posted a situational analysis (blog post by Carl Windsor, dated June 19, 2026) saying it is aware of reports of a credential-harvesting campaign targeting Fortinet devices. Security vendors including Bitdefender and Dataprise have published technical advisories and guidance, and reporting indicates government-level concern (Dataprise notes a CISA warning in its coverage).
Source Comparison
Aligned reportingCorroborates
- BleepingComputer↗Confirms that a campaign called FortiBleed exposed Fortinet VPN credentials and reports the scale at roughly 73,000 affected FortiGate devices, supporting the briefing's scale claim.
- fortinet.com↗Provides Fortinet's situational analysis (Carl Windsor, June 19, 2026) acknowledging reports of a credential-harvesting campaign targeting FortiGate devices, matching the briefing's Fortinet citation.
- businessinsights.bitdefender.com↗Publishes a Bitdefender technical advisory analyzing the FortiBleed credential-exposure campaign and offering guidance, supporting the briefing's note that security vendors issued technical advisories.
- recordedfuture.com↗Provides Insikt Group / Recorded Future's specific figure of 73,932 FortiGate systems impacted, directly matching the briefing's Recorded Future citation.
- dataprise.com↗Dataprise's coverage warns customers about FortiBleed and notes a CISA warning, corroborating the briefing's claim of government-level concern and vendor guidance.
- doublepulsar.com↗Reports that about 75,000 Fortinet firewalls had admin passwords exposed, aligning with the briefing's higher-end estimates of roughly 73,000–75,000 affected systems.
- srnnews.com↗Reports that Fortinet acknowledged a credential-harvesting campaign targeting its firewalls and VPN devices, corroborating the briefing's summary of Fortinet's response.
- csoonline.com↗Reports the FortiBleed campaign exposed about 75,000 Fortinet firewalls worldwide and notes affected organizations across 194 countries, corroborating the briefing's scale and geographic exposure claims.