Fortinet Reports Data Breach After Hacker Claims to Exfiltrate 440GB of Files

Fortinet, a prominent figure in the cybersecurity realm, has acknowledged a significant data breach subsequent to assertions by a threat actor regarding the exfiltration of 440GB of data from the company’s Microsoft SharePoint server.

Fortinet, recognized globally for its cybersecurity solutions, offers a spectrum of secure networking tools such as firewalls, routers, VPNs, SIEM, EDR/XDR tools, and consulting services.

On 12th Sep 2024, a known threat actor disclosed on a hacking forum that they had breached Fortinet’s Azure SharePoint environment, absconding with the data. They also shared access credentials to an alleged S3 bucket where the stolen data was being disseminated to other malicious actors.

The threat actor, operating under the pseudonym “Fortibitch,” asserted that they had tried to extort Fortinet by demanding a ransom to avert the public disclosure of the data. However, Fortinet purportedly declined to comply.

In response to queries about the breach, Fortinet confirmed that the incident involved unauthorized entry to a “third-party cloud-based shared file drive,” housing customer data. The company clarified that only a limited number of files were accessed, affecting a small subset of Fortinet customers.

However, Fortinet refrained from specifying the number of impacted customers or the type of compromised data, indicating only that it had “communicated directly with customers as appropriate.”

In a subsequent update on its website, Fortinet clarified that the breach impacted less than 0.3% of its customer base and assured that no malicious activities had been directed at those customers as a consequence of the incident.

Fortinet also confirmed that the breach did not entail data encryption, ransomware, or unauthorized access to Fortinet’s corporate network.