70,000 Credentials Stolen: What the Firewall Breach Means for You

Michael Miller · 2026-10-23

You know that feeling when you leave the front door unlocked and later wonder if someone walked in? That's basically what happened to over 70,000 organizations. Researchers just exposed a massive campaign where hackers slipped through enterprise firewalls and VPNs — the very tools we trust to keep intruders out. ### The Breach: What Went Down Security teams discovered a widespread attack targeting exposed network edge devices. We're talking about Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls — the gatekeepers of corporate networks. These devices sit at the perimeter, guarding the castle. But when they're misconfigured or unpatched, they become open windows. The investigation revealed that attackers didn't just grab credentials and leave. They stuck around. According to the researchers, "operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims." That means they were digging deeper, looking for ways to expand their foothold. ### Why This Hits Close to Home If you're running a business, you might think your firewall is enough. But here's the thing: a firewall is only as strong as its configuration. Default passwords, missing patches, and exposed management interfaces are like leaving a spare key under the mat. Attackers know exactly where to look. And it's not just big enterprises. Small and mid-sized businesses are often the easiest targets because they lack dedicated security teams. The attackers don't discriminate — they scan the internet for vulnerable devices and strike. ### What You Can Do Right Now You don't need a security operations center to protect yourself. Start with these practical steps: - **Patch immediately.** Check your firewall and VPN firmware for updates. Apply them without delay. - **Change default credentials.** Yes, even the ones you think nobody knows about. - **Limit exposure.** Don't leave management interfaces accessible from the public internet. - **Enable multi-factor authentication (MFA).** It's a simple layer that stops most credential-based attacks. - **Monitor logs.** Look for unusual login attempts or traffic patterns. > "The best defense is assuming you're already a target. That mindset changes everything." ### The Bigger Picture This campaign is a wake-up call. It shows that even our security tools can be turned against us if we're not careful. The researchers haven't named all the affected organizations, but the scale — 70,000 credentials — suggests this is just the tip of the iceberg. So, take a moment today to check your perimeter defenses. It's not about paranoia; it's about being smart. After all, the bad guys are already scanning. Don't make it easy for them.