FortiBleed 2.0: earlier FortiGate configuration reports expose over 100,000 credential and account records

TLDR

• Hudson Rock analysed FortiGate configuration reports holding 101,419 credential and account records, 40,573 with cleartext secrets.¹³
• Most source files carry 20 February report dates, Hudson Rock says; HKCERT says this is not a new attack wave.¹²
• The 975 new domain labels are not 975 newly confirmed victims, and record counts do not equal valid credentials.¹²³

Hudson Rock published FortiBleed 2.0 on 27 October 2026, a follow-up to its earlier FortiBleed investigation, based on FortiGate configuration reports its researchers obtained only recently.¹³ The analysis covers 1,703 configuration-report files containing 101,419 credential and account records tied to 1,689 host identifiers, of which 40,573 records hold cleartext secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records.¹ The material also includes administrator logins, SMTP credentials and high-availability cluster secrets.¹ HKCERT issued an alert on 28 October that describes the dataset as holding over 100,000 credential and account records.²

Hudson Rock counts 1,453 distinct domain labels in the data, of which 975 (67.1 per cent) are absent from its FortiBleed 1.0 comparison set, and 924 of the 1,689 host identifiers are also new.¹ Hudson Rock and Cyber Security News caution against reading those totals as victim counts: domain labels can belong to service providers, registration contacts or account holders, so they should not be read as 975 newly compromised companies.¹³ HKCERT says the record and domain-label totals do not correspond to unique users, credentials that remain valid, or newly confirmed affected organisations, and that a host identifier may be an IP address or hostname rather than one appliance or organisation.² Hudson Rock reports that 7,437 of the 37,076 cleartext local-user records are marked disabled, and that "verified login" is a category in the dataset, not a fresh authentication test.¹

On timing and cause, Hudson Rock says 1,672 of the 1,703 source files carry report timestamps of 20 February 2026 while 31 are undated, and that these are report dates, not established dates of compromise or configuration extraction.¹ HKCERT says the material predates the data examined in the first investigation, which it says was believed to date from May or June 2026, and that FortiBleed 2.0 should not be interpreted as a new wave of attacks.² Cyber Security News describes it as a follow-up based on recently obtained files, not a newly disclosed vulnerability, and Hudson Rock says the records do not establish a single initial-access mechanism for every host.¹³ The sources differ slightly on the earlier dataset: BleepingComputer reported in June that it covered 73,932 unique firewall URLs, while Hudson Rock now describes 73,932 login rows across 69,055 host identifiers.¹⁴

For background, BleepingComputer reported on 18 June 2026 that the original FortiBleed leak exposed what appeared to be Fortinet VPN credentials, and that researcher Kevin Beaumont said the data appeared to come from exported Fortinet configurations.⁴ Fortinet's 19 June blog said it believed that activity involved threat actors reusing credentials from previous incidents and brute-forcing devices with weak password hygiene and no multi-factor authentication, and stated: "This is not a new Fortinet vulnerability."⁵ That statement was made on 19 June about the original FortiBleed.⁵ HKCERT now urges organisations that already checked their domains after its June alert to check again against Hudson Rock's updated lookup portal, rotate administrator, VPN and LDAP credentials, enable multi-factor authentication and restrict management access.² Hudson Rock adds that some stored FortiOS ENC values can be recovered offline when a configuration uses the system-default encryption key, depending on version, settings and the material obtained.¹

Why it matters: firewall configuration exports can hold VPN, directory and cluster secrets, so organisations that already checked after the June alert are being told to check again, though the sources stress the counts do not show how many credentials still work.¹²³