Fortinet Fortigate VPN Credentials Leaked Online

Published on 09 Sep 2021

Updated on 13 Sep 2021

This is an update to the alert.

Fortinet has published handbooks to harden the FortiGate for FortiOS 5.6, 6.0, 6.2, 6.4. Please refer to the respective handbooks below:

FortiOS 5.6:

FortiOS 6.0:

FortiOS 6.2:

FortiOS 6.4:


Original alert published on 9 Sep 2021 below:

Approximately 500,000 Fortinet Fortigate VPN login credentials were leaked on a hacking forum, according to reports. The exposure of the credentials could allow an attacker to access a network to perform malicious activities such as data exfiltration, malware installation, and ransomware attacks.

Administrators of Fortinet VPN are advised to perform the following measures:
Ensure that the products are patched to the latest versions immediately. If administrators are unable to do so immediately, disable the VPN feature.
Perform a forced reset of all users' passwords, and set new strong passwords immediately.
Consider enabling two-factor authentication (2FA) to secure the VPN accounts, using external authentication services where possible.
Check the Fortigate appliance's Audit Event log and VPN Event Log for signs of unauthorised or unusual logins, such as logins using valid credentials but from abnormal overseas IP address or logins at an unusual time of day.
Monitor the network for any suspicious activities such as possible intrusion attempts.

More information is available here: