SonicWall Backup Leak: Administrators Urgently Urged to Act

SonicWall, a leading global provider of network security, has confirmed that all of its customers’ cloud backups of their firewalls have been compromised. The attack exposed data that could include encrypted accounts and network configurations. SonicWall explained in an updated statement dated October 10, 2025 that it had previously reported fewer than 5% of affected customers, but now the scale of the incident has become global, with virtually all users of its cloud backup service at risk.

The company warned that while the files remain encrypted, their exposure to attackers could increase the risk of targeted attacks on corporate networks.
SonicWall urged administrators to immediately:

• log in to the MySonicWall portal,

• check if their devices are on the vulnerable list,

• change passwords for all local users,

• reset TOTP codes and update credentials on related services.

Particular attention is advised to pay attention to devices with open Internet services, as they are the most vulnerable targets.

It seems that the attack was the result of brute-force attempts to access the MySonicWall.com web portal. This is not the first incident for the company: in 2025, SonicWall already faced a number of critical vulnerabilities, some of which were actively exploited by cybercriminals.

In particular, vulnerabilities in the SMA1000 Appliance Management Console and Central Management Console allowed the execution of arbitrary code without authentication. In August, the Shadowserver Foundation reported that more than 3,200 SonicWall SMA100 appliances remained unpatched despite updates, highlighting a long-standing problem for users with keeping their systems up to date.

The SonicWall incident proves once again that no cloud infrastructure is completely secure, even when it comes to security companies.

The key actions for administrators now are a full password audit, token reset, and immediate firmware updates. Failure to respond could lead to targeted attacks, including hacking corporate VPNs or changing configurations.