SonicWall says state-sponsored hackers behind September security breach

SonicWall disclosed that state-sponsored threat actors accessed firewall configuration backup files stored in MySonicWall cloud accounts in September; Mandiant confirmed the activity was limited to those cloud backups and SonicWall reported no compromise of products, firmware, source code, or customer networks. The exposed files could contain credentials and tokens that would make it easier to exploit customer firewalls, prompting SonicWall to advise widespread credential and secret resets; the vendor also said the incident impacted customers using the cloud backup service and is unrelated to a separate Akira ransomware incident.