The attack, dubbed FortiBleed by researchers, has been active since at least February 2026. More than 80,000 Fortinet firewalls have been compromised across 194 countries. Cybersecurity firm SOCRadar has verified a database of more than 86,644 working login credentials. UK accounts in the dataset include IT staff at British embassies in Thailand and Mauritius and local government workers in Derbyshire and Waltham Forest.
