What is known
SOCRadar counts 86,644 compromised FortiGate firewalls in 194 countries. On 6 October 2026 the FBI and US Secret Service jointly warned about the ongoing attacks. Instead of a new flaw, the attackers use credentials from earlier leaks and infostealer logs via credential stuffing and password spraying. In some cases they changed admin accounts and locked owners out.
Fortinet considers the data largely an aggregation of earlier incidents. Independent researchers report that many credentials are nevertheless still valid.
Why this affects OT
In many companies the perimeter firewall is also the VPN entry point for vendors. Whoever controls it is directly inside the network and, without internal segmentation, often only a few steps from production.
What you should do now
- Change all admin and VPN passwords, then log in once more so new password hashes are written.
- Enforce multi-factor login for every admin and VPN account.
- Do not expose the management interface to the internet.
- Review admin accounts and configuration changes from recent weeks.
- Internal firewalls between IT and OT, so that a perimeter breach is not automatically a plant breach.
This article is for general information and is not legal advice.
