Organizations that checked their Fortinet firewalls against the FortiBleed leak in June need to check again. Hong Kong's computer emergency response team, HKCERT, has issued a new security alert on FortiBleed 2.0, a follow-up investigation by researchers who obtained an earlier set of FortiGate configuration reports containing more than 100,000 credential and account records.
The new data goes deeper than the first batch. It includes cleartext secrets for local users, administrator logins labelled as verified in the source dataset, Active Directory LDAP bind accounts, high-availability clusters and SMTP services. It also covers hosts that were missing from the earlier dataset: the analysis found 975 domain labels that did not appear in the first FortiBleed release.
Older data, not a new wave of attacks
HKCERT is careful about what the dataset does and does not show. Most source files carry report dates in February 2026, earlier than the May or June material behind the first investigation, so FortiBleed 2.0 should not be read as a new wave of attacks. Those report dates also do not establish when the actual compromise or data theft took place.
The headline numbers need the same care. HKCERT notes that the count of records and of domain labels does not correspond to unique users, credentials that still work, or newly confirmed victims, and a host identifier can be an IP address or hostname rather than one appliance or organization. Some records may belong to disabled accounts or passwords that have since been changed.
HKCERT's first alert in June described more than 70,000 Fortinet devices suspected of being affected. We reported on related credential attacks against Fortinet and Sophos firewalls in Hackers spray Fortinet and Sophos firewalls to steal corporate logins.
Why a firewall config leak reaches past the firewall
A FortiGate configuration file holds the credentials the appliance uses to talk to the rest of the network. HKCERT lists the risks organizations should assess, while stressing the dataset does not prove any of them happened: logging in to the management interface or VPN, abusing exposed LDAP bind or service accounts, mapping internal directory servers, changing firewall policies, moving laterally, and deploying malware or ransomware.
Re-check the lookup portal, then rotate every secret
HKCERT asks every organization running Fortinet firewalls, VPNs or related appliances to reassess its risk now. Its recommended steps:
- Check current and former domains in the FortiBleed lookup portal at hudsonrock.com/fortinet, even if you checked in June, and reconcile IP addresses and hostnames with historical asset records.
- Inventory every FortiGate you run or ran, including replaced, decommissioned or re-addressed units and those managed by suppliers.
- Rotate administrator, local-user and VPN credentials, end their sessions, and reset reused passwords.
- Rotate LDAP bind and service account credentials and trim unneeded privileges.
- Replace HA, RADIUS and SMTP secrets and, as a precaution, API keys, integration accounts, certificates and private keys referenced in the configuration.
- Keep management interfaces off the internet and enforce multi-factor authentication for all admin and remote access.
- Review admin and VPN logins, configuration exports and account changes, and compare current configurations with known-good backups.
HKCERT adds that upgrading FortiOS still matters, but a patch does not undo an exposure that has already happened. If the secrets left the building, only rotating them closes the door.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.