FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls

FortiBleed: a publicly reported dataset containing admin credentials and exported configurations for approximately 73,932 FortiGate devices (around 50% of internet-facing Fortinets) appears legitimate; attackers intercepted and cracked VPN/authentication hashes (using a 45-GPU Hashtopolis cluster), conducted massive credential attempts, and assembled a sales-style catalog of targets across critical vendors and governments — enabling remote firewall access, network takeover, and persistence. Immediate mitigations advised include rotating admin credentials, checking for unauthorized admin logins, upgrading FortiOS and forcing admin logins to trigger PBKDF2 storage, disabling internet-facing management, and enforcing MFA.