Fortinet customer data stolen from third-party file-sharing service

Dive Brief:

An attacker gained access to Fortinet customer data stored on a third-party cloud-based shared file drive, the company said in a Thursday blog post. The cybersecurity company did not specify when the intrusion took place.
The breach exposed “a limited number of files” including data related to less than 0.3% of Fortinet customers, the company said. Fortinet ended the second quarter with more than 500,000 customers.
“To date there is no indication that this incident has resulted in malicious activity affecting any customers,” Fortinet said in its notice about the incident. “Fortinet’s operations, products, and services have not been impacted, and we have identified no evidence of additional access to any other Fortinet resource.”

Dive Insight:

The breach of Fortinet customer data marks yet another attack originating in a file-sharing or -transfer service, a common attack vector for opportunistic cybercriminals.

Fortinet is one of the largest cybersecurity companies in the world with a 15% share of the global firewall market, according to Dell’Oro Group. The company ended the second quarter with $380 million in net income on $1.43 billion in revenue.

Fortinet hasn’t disclosed the root cause or named the third-party source of the attack, but the company reported the security incident after a hacker posted details of an alleged leak of Fortinet customer data on a hacking forum.

The company declined to answer questions about how the attacker gained access or when it became aware of the breach.

“The incident did not involve any data encryption, deployment of ransomware or access to Fortinet’s corporate network,” the company said in the blog post.

Fortinet said it terminated the unauthorized individual’s access, contained the incident, notified law enforcement and cyber authorities, and began an investigation into the incident.

Fortinet hasn’t disclosed the attack in a filing with the Securities and Exchange Commission, but said it doesn’t currently believe the incident will have a material impact on its financial condition or operating results.