Hudson Rock's second FortiBleed dataset, published 27 October 2026, adds 1,703 FortiGate configuration reports holding 40,573 records with cleartext credentials. These are working logins, not hashes, and a firmware update does nothing about them.
What happened
The analysis covers 101,419 credential and account records spread across 1,703 configuration reports linked to 1,689 host identifiers. Of those identifiers, 924 did not appear in the first FortiBleed dataset, so this is not a recount of the same devices.
The composition is the story. The 40,573 cleartext records break down into 37,076 local-user entries, 1,576 Active Directory LDAP bind records, 1,672 administrative logins, 144 high-availability cluster records and 105 SMTP records. A further 13,999 records carry hashes and 10,743 are FortiOS ENC values, which can be recovered offline where a device still uses the system-default encryption key.
No new CVE is attached to this. It is the same credential-theft campaign the FBI and US Secret Service described in a joint advisory in October, which recorded verified compromises of 86,644 devices across 194 countries.
Who is affected
Any organisation with an internet-facing FortiGate or SSL VPN gateway that was exposed earlier this year, whether or not it has since been patched.
- Estates where a FortiGate configuration file sat on a machine infected with infostealer malware.
- Devices using the default encryption key, where stored values can be decrypted offline by anyone holding the file.
- Networks reusing one LDAP bind account across the firewall, VPN directory lookups and other services.
- Anyone who carried an old admin password or bind account forward to a replacement appliance.
What to do now
Rotate every credential stored in the FortiGate configuration, then terminate all administrative and VPN sessions.
- Reset local admin, VPN user, LDAP bind, RADIUS shared secret and SMTP credentials held on the appliance.
- End active sessions after the reset so existing tunnels and tokens die with the old password.
- Audit local, administrative and API accounts for logins nobody recognises, since this campaign created admin accounts for persistence.
- Take management access off the internet, or restrict it to trusted hosts or a local-in policy.
- Enforce MFA on admin and VPN logins, and prefer phishing-resistant factors.
What this means for South African businesses
FortiGate is one of the most common perimeter devices in this market, and most SMEs treat the configuration as something only the installer ever sees. A copied configuration is a copy of your perimeter identity: VPN accounts, the directory bind account that ties the firewall into Active Directory, and the secrets shared between high-availability pairs.
My judgement is that the practical risk here is reuse rather than the published list. Where the same bind account or admin password was carried from an old appliance to a new one, a configuration leaked in 2025 still opens the current firewall. Rotating those accounts is a half-day exercise and it is the only measure that actually closes this, because no patch invalidates a credential that has already left the building.
Hudson Rock's second dataset is reported in detail at cyberpress.org.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.