FortiBleed: The Broker Who Turned 73,000 Firewalls Into a Product Catalog

A security researcher discovered an exposed server containing valid login credentials for 73,932 Fortinet devices spanning 21,632 organizations in 194 countries; the data was part of an access-brokering operation run by a seller (“SantaAd”) who performed large-scale brute-force and cracking activity, cataloged victims with revenue/sector metadata for resale, and advertised live auctions—indicating active criminal resale (likely to ransomware actors) and a systemic operational pipeline leveraging rented infrastructure and AI-driven tooling.