Over 75,000 Fortinet device administrator credentials have been compromised, with the data likely obtained from exports of device configurations. The compromised devices are mostly Fortinet firewalls facing the internet, with many still online and including devices with recent patches. The data set is distinct from a previous leak involving 15,000 devices and covers a different set of IP addresses. The compromise affects approximately 15% of internet-facing Fortinet devices based on Shodan data. The information was shared by security researchers including Volodymyr Diachenko, Hunt Intelligence, Hudson Rock, and Kevin Beaumont, and disseminated via a Reddit cybersecurity post linking to a LinkedIn profile.

The compromise exposes administrator credentials for a large number of Fortinet devices, potentially allowing unauthorized access to these devices. This could lead to unauthorized configuration changes, interception of network traffic, or further network compromise. The affected devices include many that are still operational and patched, indicating that the compromise is not limited to unpatched systems. The scale of the compromise suggests a widespread risk to organizations using Fortinet devices exposed to the internet.

No official patch or fix is indicated as this is a credential compromise rather than a software vulnerability. Organizations should immediately rotate administrator credentials on Fortinet devices, especially those accessible from the internet. It is recommended to restrict or block internet access to Fortinet administrative portals where possible. Reviewing device and network logs for suspicious activity is advised. Use the Hudson Rock website referenced in the source to check if your organization's devices are affected. Follow any additional guidance from Fortinet and security researchers involved in this disclosure.