Data breach: Fortinet faces new hack, 440GB of stolen information

A hacker known as Fortibitch has claimed to have stolen 440 GB of data from Fortinet, a leading cybersecurity company. The company confirmed the incident, but tried to downplay its impact, saying the amount of data affected was limited and there was no evidence of malicious activity directed against the users involved. However, potential privacy risks emerged as the hacker, after a failed extortion attempt, made the files public by making them available on an Amazon S3 bucket and disclosed the credentials used to access the data, likely stolen from Fortinet's Azure SharePoint servers.

Risks to user privacy

Despite Fortinet’s assurances, the public release of the data could still pose risks to user privacy. Hackers have made the credentials used to access the data available, increasing the likelihood that other attackers could exploit them for further attacks. Fortinet estimated that approximately 0.3% of its customers were affected by the incident and said it has taken immediate steps to strengthen internal security, including improvements in account monitoring and detection of potential threats. The situation has been communicated directly to affected customers to ensure full transparency into how the company is handling the crisis.

Fortinet's response and security hardening measures

In the official statement, Fortinet noted that an unauthorized individual was able to access a limited number of files stored on a third-party cloud-based shared file system. These files included data pertaining to only a small number of customers. The company said it had no indication of malicious activity related to the incident and that Fortinet's operations, products, and services were not compromised. Following the incident, the organization has further enhanced its internal security measures to prevent similar events in the future, focusing on tighter account management and increased detection of potential threats.

Previous security breaches for Fortinet

This is not the first time that Fortinet has been at the center of hacking episodes. Already in 2021, the administrator of the hacking forum RAMP published the login credentials for the company's VPN service, compromising the information of approximately 498,908 users, including many Italians. Although the current attack is smaller in scale, Fortinet has stated that it does not expect any negative impact on its revenues. Continued attention to security issues therefore becomes crucial for the company, which must maintain the trust of its customers and further strengthen its defenses against cyber threats in an evolving context.