Pierluigi Paganini September 12, 2024

Fortinet disclosed a data breach after a threat actor claimed the theft of 440GB of files from the company’s Microsoft Sharepoint server.

Today, Fortinet told Cyber Daily that a threat actor gained unauthorized access to a third-party service it used.

“An individual gained unauthorized access to a limited number of files stored on Fortinet’s instance of a third-party cloud-based shared file drive, which included limited data related to a small number of Fortinet customers, and we have communicated directly with customers as appropriate,” a company spokesman told Cyber Daily.

A threat actor that goes online with the moniker ‘Fortibitch’ claimed the theft of 440GB of files from the company’s Microsoft Sharepoint server.

The threat actor taunted the company, doubting its capabilities even after the acquisition of firms specializing in cloud security and data loss prevention.

“Fortinet has recently acquired Next DLP. FYI, DLP is Data Loss Prevention. They’ve also acquired Lacework, a cloud security company. Guess what? Their Azure Sharepoint got leaked. 440 GB of data available on my S3 bucket.” reads the announcement published by Fortibitch on a cybercrime forum.

The company immediately excluded that the incident had impacted its operations.

“To-date there is no indication that this incident has resulted in malicious activity affecting any customers. Fortinet’s operations, products, and services have not been impacted.” the spokesman added.

Last month, the Australian Home Affairs department discovered the data breach involving Fortinet, although it occurred earlier. The incident impacted a limited number of files related to some Fortinet customers in the Asia-Pacific region, but there are currently no indications of malicious activity impacting those customers. Fortinet has been actively contributing to Australia’s cybersecurity landscape, recently submitting recommendations for the 2023–2030 Australian Cyber Security Strategy.

It is unclear if the Australian federal government or critical infrastructure was impacted due to the incident.

Fortinet has yet to disclose the number of impacted customers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)