FortiBleed Check

The FortiBleed leak exposed Fortinet VPN credentials including usernames and plaintext or hashed passwords, affected FortiGate device IP addresses and ports, and in later disclosures full device configurations. Attackers compiled these into a verified, searchable database targeting FortiGate SSL-VPN endpoints that had not been patched or had credentials unchanged since prior Fortinet breaches. Over 750,000 credentials and 105 million records have been identified in the dataset spanning banks, telecoms, government agencies, energy companies, and enterprises across 194 countries.

Enter your organization's domain name or public IP address into the FortiBleed checker. The tool instantly queries SOCRadar's FortiBleed dataset — the most extensive collection of verified compromised Fortinet credentials assembled for this incident — and returns whether any records associated with your domain or IP were found. The checker runs on live data, requires no account creation, and does not store your query. Results are instant.

Treat it as a confirmed credential compromise. Immediately force-reset all Fortinet VPN account passwords and admin interface credentials — any unchanged password should be considered compromised. Enable multi-factor authentication across all FortiGate admin and VPN accounts. Patch FortiOS to version 7.2.11, 7.4.8, or 7.6.1 minimum to close the legacy SHA-256 password hashing vulnerability exploited in this campaign. Review VPN and firewall logs for unauthorized access going back at least 90 days. Restrict FortiGate management interfaces from direct internet exposure and rotate any reused credentials across other systems.

Yes. The FortiBleed campaign is actively ongoing as of June 2026. Attackers continue to operate their infrastructure, adding newly compromised FortiGate devices to their database. This is not a historical breach — it is a live operation. Organizations running internet-facing Fortinet FortiGate firewalls or SSL-VPN gateways should check their exposure immediately and rotate all credentials without delay.

FortiGate firewalls and FortiOS SSL-VPN gateways are the primary targets of the FortiBleed campaign. Devices exposed to the internet with unpatched firmware, default credentials, or passwords unchanged since previous Fortinet breaches are at highest risk. Fortinet introduced stronger PBKDF2-based password hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1 — devices running older versions remain vulnerable to offline password cracking even after the configuration files are extracted.

Any organization running an internet-facing Fortinet FortiGate firewall or SSL-VPN gateway is potentially at risk. The FortiBleed dataset includes credentials from organizations across every major sector — telecommunications, government agencies, financial institutions, energy companies, and multinational enterprises with revenues in the tens of billions. No region has been spared, with significant exposure confirmed across the United States, Europe, Asia, the Middle East, and Africa. Telecom is the most heavily impacted sector with over 5,600 credential entries, followed by government with 591 entries across 111 domains.