SonicWall MySonicWall Breach Puts Firewall Backups and Credentials at Risk
In September 2025, SonicWall disclosed a security incident impacting its MySonicWall cloud platform, where firewall configuration backup files were accessed by threat actors following a series of brute-force attacks. The breach, affecting less than 5% of SonicWall firewalls, exposed configuration data that included encrypted passwords and sensitive information, potentially easing future exploitation of affected devices. SonicWall responded by disabling unauthorized access, notifying affected customers, and issuing urgent guidance to reset credentials, keys, and secrets for all related accounts and services. The vendor also coordinated with cybersecurity and law enforcement agencies as part of its investigation. This incident highlights a rising trend of attackers targeting cloud-based administrative services and configuration backups, exploiting brute-force methods and known vulnerabilities such as CVE-2024-40766. Organizations face increased pressure to secure not only device firmware but also backup repositories and credentials, underscoring the persistent threat of credential-based and configuration compromise attacks.
Kill Chain