Cybersecurity researchers have disclosed a large-scale campaign targeting internet-exposed network edge systems, including Fortinet FortiGate and Palo Alto Networks GlobalProtect devices. According to the report, the activity led to the exposure of more than 70,000 credentials and appears to have affected organisations in multiple countries.

While the full scope and victim count have not been independently verified in the source text provided, the reported campaign is significant because firewalls and VPN gateways often sit at the front door of a company’s network. If attackers gain access there, they may be able to move further into internal systems, user accounts and business applications.

What happened

The report describes a campaign focused on exposed network edge devices such as enterprise firewalls and remote access platforms. The named technologies include Fortinet FortiGate and Palo Alto Networks GlobalProtect, both widely used by businesses to secure traffic and support remote access.

Researchers said artifacts from the investigation indicate that the operators obtained access to numerous organisations worldwide and attempted to deepen access in at least some cases. The source headline states that more than 70,000 credentials were exposed, although the exact mechanism, timeline and scale of downstream compromise would need to be confirmed through the original technical findings and vendor guidance.

Why it matters for European businesses

For European companies, this is relevant because edge security devices are common across SMEs, larger enterprises, e-commerce operations and distributed teams. VPNs and firewalls often protect access to business-critical systems such as cloud administration panels, email, ERP platforms, customer data environments and internal web tools.

If credentials linked to these systems are exposed, the risk is not limited to one appliance. Attackers may try to reuse passwords, escalate privileges, bypass normal login protections or gain a foothold for ransomware, data theft or email compromise.

The incident also matters from a compliance and operational perspective. Businesses operating under GDPR, sector-specific rules or cybersecurity obligations such as NIS2-related requirements may need to show that they manage external-facing infrastructure, access control and incident response in a structured way.

Who may be affected

• SMEs using firewall or VPN appliances for remote staff, branch offices or third-party access
• E-commerce companies that rely on secure access to hosting, payment, order management or back-office systems
• IT teams and managed service providers responsible for patching and monitoring internet-facing security devices
• Regulated businesses handling sensitive customer, financial or operational data
• Companies with hybrid or remote work models where VPN and identity systems remain a key control point

What companies should consider

• Review exposed edge devices: Identify all internet-facing firewalls, VPN gateways and remote access systems in use across offices, cloud environments and subsidiaries.
• Check vendor advisories: Review current guidance from relevant vendors, including Fortinet and Palo Alto Networks, and apply available security updates where appropriate.
• Audit credentials: Reset passwords and rotate credentials tied to affected or potentially affected systems, especially privileged and shared administrative accounts.
• Enforce stronger authentication: Use phishing-resistant multi-factor authentication where possible for administrative and remote access accounts.
• Inspect logs and alerts: Look for unusual logins, configuration changes, new accounts, unexpected VPN sessions and signs of lateral movement after edge access.
• Limit direct exposure: Reduce unnecessary internet exposure of management interfaces and restrict administrative access by IP, network segmentation or zero-trust controls.
• Test incident response readiness: Ensure internal teams or external providers know how to isolate compromised devices, preserve evidence and assess potential data exposure.

Although the available source text does not provide full technical detail, the reported campaign is a useful reminder that exposed perimeter systems remain a high-value target. For businesses in Europe, especially those with lean IT resources, basic control discipline around patching, credential hygiene and remote access monitoring remains one of the most practical ways to reduce risk.