A cybersecurity research group monitoring underground forums has uncovered a database containing approximately 74,000 working Fortinet administrative credentials — a finding that is sending shockwaves through the security community because many of the compromised devices had already received patches for the underlying vulnerability. The incident, now being tracked internally as FortiBleed, exposes a dangerous gap in how organizations respond to security disclosures: patching the vulnerability is not the same as evicting the attacker.

According to data released by threat intelligence firm SOCRadar, the compromised credential database as of June 19 contained logins for 86,644 devices, with generic admin accounts making up 35% of compromised credentials and built-in Fortinet system accounts accounting for an additional 28.3%. The scale of the breach suggests a systematic, automated campaign rather than targeted opportunistic attacks.

The attackers reportedly used a GPU computing cluster to crack the credentials. While modern hardware-accelerated password cracking has been possible for years, the economics have changed dramatically. Cloud GPU instances available for rent have made brute-force attacks against password hashes financially viable for even moderately resourced threat actors. When organizations rely on weak or default credentials on network perimeter devices — as a disturbingly high percentage do — the combination of a credential exposure incident and GPU cracking represents a devastating one-two punch.

The "already patched" dimension of this story is perhaps its most important lesson. When Fortinet disclosed the original vulnerability, many organizations dutifully applied patches and considered the matter closed. But patching addresses the vulnerability — it does not revoke credentials that may have been exfiltrated before the patch was applied. Attackers who harvested credentials during the exploitation window continued to hold valid logins even after the security hole was closed.

Cybersecurity experts emphasize that responding to this incident requires a process-level intervention rather than simply applying a software patch. Organizations must force complete re-authentication across their entire Fortinet device fleet, verify that no unauthorized accounts were created during the compromise window, audit firewall configurations for unauthorized changes, and implement privileged access management solutions that generate and rotate credentials automatically rather than relying on static passwords.

The incident also renews debate about the security of network infrastructure devices themselves. As the front-line guardians of enterprise perimeters, firewalls and VPN gateways are high-value targets. A compromised firewall doesn't just open one door — it potentially hands attackers the keys to the entire network.