Fortinet: FortiGate config leaks are genuine but misleading

Fortinet confirmed that configuration files from FortiGate devices—containing IP addresses, firewall rules and some plaintext passwords—were stolen during a 2022 zero-day compromise and recently published by the Belsen Group, affecting around 15,000 devices; Fortinet urges patching, credential refreshes, and customer outreach. The report also highlights a separate suspected mass zero-day exploitation campaign against FortiGate firewalls in late 2024, increasing the urgency for mitigations.