The FortiBleed Database
In January 2025, a threat actor posted over 73,000 Fortinet device configurations and associated credentials on a prominent dark web forum. The dataset, named FortiBleed by researchers, was harvested via CVE-2022-40684, a critical authentication bypass in FortiOS and FortiProxy that allowed unauthenticated attackers to read configuration files from exposed management interfaces by sending a specially crafted HTTP request with a manipulated Authorization header.
CVE-2022-40684 was disclosed and patched by Fortinet in October 2022. The active exploitation period produced a massive credential harvest before organisations patched. The January 2025 publication was a delayed release of this harvest. By the time the database appeared publicly, some credentials were stale. Others were not. Fortinet VPN credentials do not expire automatically, and credentials extracted from FortiGate configurations include SSL-VPN user accounts that remain valid until manually rotated.
The database covers FortiGate appliances in 194 countries. US organisations represent the largest share. Healthcare, manufacturing, and professional services companies appear throughout the dataset, reflecting the broad Fortinet installed base in those sectors.
INC Ransom and Lynx: Credential Recycling
Ransomware groups are efficient about initial access. Developing novel exploit chains is expensive. Purchasing or obtaining bulk credential databases is cheap and effective if a significant fraction of credentials remain valid.
Threat intelligence researchers monitoring INC Ransom and Lynx affiliate activity in 2026 have corroborated FortiBleed credentials as an initial access vector in 12 confirmed victim intrusions this year. The attribution methodology is IP-based: VPN session logs from victim FortiGate appliances showed authentication events from IP addresses associated with the threat actors, authenticating with credentials present in the FortiBleed database, before network activity consistent with ransomware pre-positioning was observed.
INC Ransom has used FortiBleed credentials primarily against healthcare and legal sector targets in North America and Western Europe. Initial VPN access is followed by legitimate-tool lateral movement (PsExec, WMI, RDP), credential dumping (Mimikatz, secretsdump), targeting of backup systems, and ultimately ransomware deployment after data exfiltration to Mega or rclone targets.
Lynx ransomware affiliates, who have demonstrated a higher operational tempo and shorter dwell time than INC Ransom, have used FortiBleed credentials in manufacturing sector intrusions, compressing the time from initial VPN access to ransomware deployment to as little as 72 hours.
The common factor in confirmed FortiBleed-sourced intrusions: the victim organisation patched CVE-2022-40684 after the October 2022 disclosure but did not rotate VPN credentials. Patching the vulnerability prevents new credential extraction. It does not invalidate credentials already extracted.
Sectors and Impact
Healthcare: Four confirmed FortiBleed-sourced intrusions in 2026 targeted hospital networks and healthcare service providers. INC Ransom’s preference for healthcare targeting aligns with the sector’s reputation for paying ransoms to restore clinical operations. In one case, a regional hospital system was encrypted across multiple sites, with operational disruption lasting 11 days and a ransom paid to recover from inadequate backups.
Legal: Law firms with Fortinet perimeter infrastructure appear in the database at notable density. The confidential client data in legal environments creates extortion leverage that makes the sector disproportionately attractive for double extortion models. INC Ransom’s threat to release attorney-client communications has produced several payments where encryption alone might not have.
Manufacturing: Lynx affiliate activity targeting manufacturing organisations via FortiBleed credentials has been linked to shorter-dwell intrusions with higher encryption rates. Manufacturing operations with just-in-time supply chain dependencies have a lower tolerance for extended downtime, reducing negotiation time.
Are Your FortiGate Credentials in the Database?
Organisations running Fortinet VPN infrastructure since 2022 should treat their credentials as potentially compromised regardless of whether they patched promptly.
Check if your IP is in FortiBleed: Multiple security researchers have published tools or services to check whether specific IP addresses appear in the FortiBleed dataset. Fortinet has directly notified affected organisations through its PSIRT process, but notification coverage was incomplete. Check independently.
The relevant question is not whether your IP appears, but whether you rotated credentials: If your organisation patched CVE-2022-40684 but did not also force a password reset for all SSL-VPN user accounts, your credentials remain at risk even if you patched before they were published.
Remediation Steps
Immediate: Rotate all FortiGate VPN user credentials. Force password resets for every account with SSL-VPN access. This is the single most impactful action for organisations with Fortinet infrastructure. Credentials from FortiGate configurations include the hashed passwords in the extracted configuration files; stale credentials retain their risk.
Enable multi-factor authentication on VPN access. A stolen username/password combination cannot be used for VPN authentication if MFA is required. FortiGate supports MFA via FortiToken, TOTP, email OTP, and SAML-based identity providers. Enable it for all SSL-VPN user accounts. This control also mitigates the much wider category of credential stuffing attacks on VPN infrastructure.
Restrict management interface access. CVE-2022-40684 exploited the management interface. Fortinet’s management interface (HTTPS/SSH on port 443 or 22) should only be accessible from dedicated management IP ranges, never from the public internet. Audit your FortiGate management interface exposure now.
Monitor for anomalous VPN authentication patterns. If a VPN user authenticates from a new country, a Tor exit node, or a VPN provider IP, that session warrants inspection before it is granted network access. FortiGate and downstream SIEM integrations can alert on authentication anomalies. The FortiBleed intrusions analysed showed consistent patterns: initial authentication from residential or commercial VPN IP ranges, followed by immediate internal network scanning.
The window for resolving FortiBleed-sourced risk has not closed. Rotating credentials today still reduces risk because FortiBleed credentials are being recycled into active attacks now, in 2026, four years after the underlying vulnerability was disclosed.