meta_id 3251533

On June 18, 2026, the National Cyber Security Centre (NCSC) issued an alert following a global campaign targeting Fortinet firewalls and VPN gateways, with indications of potential impact in the United Kingdom. A threat actor has leaked a database of credentials obtained through brute-force, dictionary, and credential stuffing attacks against internet-facing FortiGate and VPN portals. Credential stuffing involves attackers using passwords stolen from one web service to access accounts on other services, exploiting username and password reuse. Organisations using Fortinet edge devices with SSL VPN enabled should prioritise investigating whether they have been compromised. The NCSC recommends using Hudson Rock's FortiBleed Checker to assess potential exposure. If compromise is suspected, organisations should examine devices for common indicators of compromise, including unauthorised account creation and unexpected activity in log files. The NCSC advises isolating compromised devices from both the internet and internal networks, then performing a factory reset—as changing credentials alone may be insufficient if threat actors have established persistence. Organisations should preserve logs, configurations, and other artefacts before resetting devices for investigation purposes. The NCSC emphasises hardening re-commissioned systems by ensuring management interfaces are not exposed to the internet, updating to the latest version, removing out-of-support systems, changing all default and reused administrator passwords, and enforcing multi-factor authentication on all VPN and device management logins. UK organisations believing they have been compromised should report the incident and consider engaging an assured cyber incident response provider. The NCSC also recommends investigating other edge devices sharing credentials with compromised systems and monitoring firewall logs for suspicious activity to ensure onward compromise has not occurred within the network.