Skip to content
FortiBleed 2.0 Exposes Over 101,000 Credentials and 975 New Domains

FortiBleed 2.0 Exposes Over 101,000 Credentials and 975 New Domains

First seen 28 Oct 2026, 13:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 15:09 UTC
  • •FortiBleed 2.0 reveals over 101,000 credential records, including 40,573 cleartext secrets.
  • •975 new domain labels were identified, expanding the scope of the initial FortiBleed incident.
  • •Organizations are urged to reassess their exposure using the updated dataset from FortiBleed 2.0.

The FortiBleed 2.0 investigation has revealed a significant credential exposure incident involving Fortinet's FortiGate firewalls. Researchers uncovered 101,419 credential and account records, including 40,573 cleartext secrets, from 1,703 configuration reports dated around February 2026. The analysis identified 975 new domain labels not present in the original FortiBleed dataset. This follow-up investigation does not indicate a new wave of attacks, as the report dates predate the earlier findings. Organizations previously checked against the June 2026 alert are advised to reassess using the updated dataset. The exposure includes configuration data, such as local user secrets and Active Directory LDAP bind records. The incident primarily affects organizations using Fortinet's products, with no specific CVEs reported. The findings were published by HKCERT and corroborated by InfoStealers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-01
HKCERT issues initial FortiBleed alert
HKCERT warned of credential exposure affecting Fortinet FortiGate devices, with over 70,000 devices suspected.
Hkcert
2026-10-28
FortiBleed 2.0 findings published
New investigation reveals 101,419 credential records and 975 new domain labels, prompting organizations to reassess their exposure.
www.infostealers.com

More articles in this cluster (2)

Following this threat?

Track Fortinet in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 4

Common questions

What types of records were exposed?
The exposure includes cleartext local-user secrets, Active Directory LDAP bind records, and administrator login records.
How many new domains were identified?
The investigation identified 975 new domain labels that were not included in the original FortiBleed dataset.
What should organizations do now?
Organizations should reassess their exposure using the updated dataset from FortiBleed 2.0, even if they previously checked against the June alert.