US authorities have warned that the FortiBleed credential-harvesting campaign remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. According to the alert, the activity focuses on compromised, reused or leaked credentials and weaknesses linked to older password storage approaches.

Although the warning comes from US agencies, the operational risk is not limited to US organisations. European businesses that use Fortinet firewalls or SSL VPN access for employees, IT administrators, branches or third-party support should treat the notice as a relevant security signal.

What happened

The FBI and the US Secret Service said the FortiBleed campaign is still ongoing and continues to target Fortinet internet-facing devices, especially FortiGate firewalls and SSL VPN gateways.

Based on the source report, the campaign is centred on credential harvesting. The reported tactics include exploiting reused or leaked passwords and taking advantage of legacy SHA-256 password storage. The source also states that a large volume of Fortinet device credentials has been amassed by the threat actors.

At this stage, the article points to an active threat warning rather than a newly disclosed software vulnerability. That distinction matters for businesses: organisations may still face compromise even if they are primarily focused on patching, because identity and access controls are also part of the risk.

Why it matters for European businesses

FortiGate appliances and SSL VPN services are widely used by businesses to protect offices, cloud environments and remote access. If attackers can obtain valid credentials for those systems, they may be able to bypass perimeter defences without relying on noisy exploitation attempts.

For European companies, this has several practical implications:

• Remote access risk: Businesses using SSL VPNs for staff, contractors or managed service providers may be exposed if passwords have been reused across systems or were previously leaked.
• Security stack exposure: Firewalls and VPN gateways often sit at the edge of the network. Compromise at that layer can create a path into internal systems, cloud resources or administrative interfaces.
• Operational disruption: If firewall or VPN access is abused, organisations may face service outages, incident response costs and follow-on attacks such as ransomware or data theft.
• Compliance pressure: For organisations subject to GDPR, NIS2-related obligations or sector-specific security requirements, weak authentication and exposed remote access systems can become a governance issue as well as a technical one.

The warning is especially relevant because many SMEs rely on a small number of IT staff or external providers. That can make it easy for legacy settings, dormant accounts or reused passwords to remain in place longer than expected.

Who may be affected

The most directly affected organisations are those that use Fortinet FortiGate devices or Fortinet SSL VPN services exposed to the public internet. This may include:

• SMEs with remote staff connecting through VPN
• E-commerce businesses protecting storefront infrastructure and admin environments
• Companies with multiple offices or branch networks linked through Fortinet equipment
• Managed service providers and digital agencies administering client infrastructure
• Regulated businesses that use firewall and VPN appliances for segmented or sensitive environments

Even organisations with outsourced IT should not assume the issue is solely a supplier problem. If a provider manages network security on the company’s behalf, the business still carries operational and potentially regulatory risk if access controls are weak.

What companies should consider

Businesses using relevant Fortinet systems should review remote access exposure and credential security as a priority. Based on the source information, sensible immediate steps include:

• Identify internet-facing Fortinet devices: Confirm which FortiGate firewalls and SSL VPN gateways are publicly accessible.
• Audit authentication controls: Review whether multi-factor authentication is enabled for administrative access and remote user logins.
• Reset high-risk credentials: Prioritise password resets for administrator accounts, shared accounts, contractor access and any credentials that may have been reused elsewhere.
• Check for credential reuse: Assess whether VPN or firewall credentials overlap with other corporate systems such as email, identity platforms or hosting accounts.
• Review logs and access patterns: Look for unusual login attempts, unexpected geographies, odd login times or unexplained configuration changes.
• Remove dormant access: Disable old user accounts, former supplier logins and unused remote access paths.
• Verify current vendor guidance: Check Fortinet documentation and official security advisories for any relevant hardening, software updates or mitigation steps.

For companies with limited internal security resources, this is a practical case for asking IT teams or external providers a direct question: Which internet-facing Fortinet systems do we have, how are they protected, and when were their credentials and access settings last reviewed?

While the current warning comes from US agencies, the underlying lesson is broader. Edge security devices are only as strong as the identities used to access them. For European businesses, especially those supporting remote work or distributed operations, credential hygiene and stronger authentication remain basic but high-value defences.