Over 70,000 FortiGate devices worldwide now have their login details sitting in a leaked database. That is the warning the Cyber Security Agency of Singapore issued on 22 June 2026 in an advisory on a campaign it calls “FortiBleed.”
The agency says Fortinet firewalls and VPN gateways were hit in a credential-harvesting effort. A threat actor then leaked the resulting database after brute-force, dictionary and credential stuffing attempts against FortiGate and VPN portals that face the internet. Credential stuffing, the agency explains, means trying a password stolen from one service on accounts at other services, which works wherever people reuse the same username and password.
What attackers could do
With valid logins, intruders may gain administrative or VPN access to an affected appliance. From there they could move sideways into the internal network, change configurations without permission, or reach connected systems such as Active Directory or LDAP.
The agency’s checklist
Singapore’s advice starts with a simple question: is your organisation in the leaked data? It points to two free lookup tools, one from SOCRadar and one from Hudson Rock. After that, the steps are practical.
End every active administrator and VPN session. Reset all Fortinet VPN and administrator passwords, starting with internet-facing systems, and enforce strong password rules. Turn on multi-factor authentication for every administrator and VPN account. Upgrade to FortiOS 7.4, 7.6 or 8.0, which can store administrator credentials with PBKDF2 hashing, and remove the legacy password hashing settings.
Then look for damage. Compare device settings against a known-good baseline, and watch for accounts nobody recognises, with names such as forticloud, fortiuser, fortinet-support or fortinet-tech-support. Check logs for administrator logins from unfamiliar IP addresses, and review domain controller logs for signs of lateral movement or suspicious accounts.
Management access deserves a second look too. The agency suggests limiting external management to trusted hosts, applying a local-in policy, or switching off internet-facing administration altogether where that is possible.
A password change may not be enough
The advisory is blunt on one point. If attackers gained persistence on a device, changing credentials alone may not remove them, so the agency says a factory reset should be considered. One caution comes with it: a reset destroys logs, configurations and other evidence, so copy those off the device first if an investigation may follow.
The agency’s reference list includes Fortinet’s own analysis of the reported compromise and an advisory from the UK’s National Cyber Security Centre.
