Hackers Breached Fortinet and Palo Alto Firewalls: 70,000 Credentials Exposed

The devices meant to keep hackers out of company networks have become their way in. Security researchers have uncovered a large campaign breaking into Fortinet and Palo Alto Networks firewalls and VPNs, the gateways that protect many corporate networks. The investigation found more than 70,000 exposed credentials, including network logins and company directory records. The Fortinet and Palo Alto breach campaign is one of the largest firewall breaches of 2026, and it carries an urgent lesson for any organisation running these devices. Here is what happened and what to do.

What Researchers Found

Security firms Group-IB and NyxLab published their findings on 21 October 2026. They linked the activity to an operator known as k0t, as Cyber Security News reported. The campaign targeted three types of internet-facing equipment:

• Fortinet FortiGate firewalls
• Fortinet FortiWeb web application firewalls
• Palo Alto Networks GlobalProtect VPN portals

Once inside, the attackers collected passwords stored in device settings and used them to move deeper into victims’ networks.

What the 70,000 figure means

The researchers identified more than 70,000 exposed credentials and related records, including device logins and LDAP directory data, which companies use to manage user accounts. Importantly, they stress that this total does not mean every credential led to a successful break-in. It reflects data linked to the operation, not 70,000 confirmed compromises.

How the Attackers Got In

The operators first built lists of exposed devices using internet scanning services, focusing on vulnerable equipment rather than particular industries. They then broke in using a mix of methods, as GBHackers detailed:

• Known security flaws, including CVE-2025-64446 in FortiWeb and CVE-2026-0257, an authentication bypass in GlobalProtect.
• Brute-force password guessing against login pages.

Palo Alto Networks has separately confirmed active exploitation of CVE-2026-0257, and the US cyber security agency CISA added it to its list of known exploited vulnerabilities in May. After getting in, the attackers kept access using remote management tools and, in some cases, stole data.

Links to Ransomware

Researchers found that some victims overlapped with those of known ransomware groups, including Qilin and The Gentlemen. That suggests k0t may act as an initial access broker, a criminal who breaks into networks and sells that access to others. However, direct links to specific ransomware gangs have not been confirmed.

The campaign may also connect to an earlier wave of FortiGate compromises known as FortiBleed, reported in June, though the newly found credential dataset was not tied to previously tracked groups.

What Organisations Should Do Now

If your organisation uses FortiGate, FortiWeb or GlobalProtect, act now:

• Patch immediately, especially for CVE-2025-64446 and CVE-2026-0257.
• Reset credentials stored on or used by these devices, including VPN and administrator accounts.
• Turn on multi-factor authentication for VPN and admin access.
• Limit internet exposure of management interfaces.
• Review logs for unusual logins, new accounts and remote management tools you did not install.
• Check LDAP and directory accounts for signs of misuse.

This week has delivered a string of serious security warnings, from the PHP2Shell flaws to the Node2Shell bug and an AI-assisted attack on Microsoft 365 tenants. Our cybersecurity tips for businesses guide covers more steps.

The Front Door Needs Locking

The k0t campaign shows that security devices are only as strong as their patches and passwords. When the gateway itself is compromised, everything behind it is at risk. Patch your firewalls and VPNs, reset stored credentials and turn on multi-factor authentication today.

Frequently Asked Questions

Who is behind the attacks?

Researchers link the activity to an operator known as k0t, possibly working with collaborators.

Were 70,000 organisations hacked?

No. The 70,000 figure refers to exposed credentials and records, not confirmed compromises.

Which devices are affected?

Fortinet FortiGate and FortiWeb devices, and Palo Alto Networks GlobalProtect VPN portals.

Is this connected to ransomware?

Some victims overlap with ransomware groups, but direct links have not been confirmed.