Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign that compromised exposed Fortinet and Palo Alto firewalls, stealing more than 70 000 credentials. The incident highlights the importance of continuous configuration monitoring and audit‑ready evidence for network perimeter controls.
ADTP Breach Watch· October 23, 2026· The Hacker News
SeverityHigh
Type🔑 Breach
ConfidenceHigh
ReportedOct 23, 2026
Other / UnknownFinancial servicesHealthcare providersManufacturing firmsSaaS and technology companiesMisconfiguration
What happened
A coordinated threat actor accessed publicly exposed FortiGate and GlobalProtect firewalls, harvested over 70 000 valid credentials, and attempted lateral movement within victim networks.
Why it matters for trust and compliance
The incident underscores the need for continuous control‑mapping of edge device configurations and immutable logging to provide defensible evidence for audit and regulatory reviews.
Continuous evidence of firewall configuration compliance supports audit readiness across multiple frameworks.
Automated monitoring of edge‑device logs creates a defensible trail for incident response and governance.
Who is affected
Financial servicesHealthcare providersManufacturing firmsSaaS and technology companies
Recommended actions
Create an up‑to‑date inventory of all internet‑facing firewalls and VPNs.
Enforce secure baseline configurations and enable continuous compliance monitoring.
Rotate credentials regularly, enforce MFA for VPN access, and centralize log collection.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.