Fortinet left its own data on an unguarded cloud drive — a hacker sold 440GB of it

In mid-January 2025 a threat actor using the handle 'Fortibitch' began posting on a hacker forum, claiming to have stolen roughly 440GB of data from Fortinet, one of the world's largest network-security vendors. The actor said the haul — dubbed 'Fortileak' — had been pulled from a Microsoft Azure-hosted SharePoint file drive Fortinet used as a shared, external file-storage platform, and offered the data for sale after publishing small sample files as proof.

Fortinet confirmed the intrusion with an unusual admission: it told customers that a 'limited' amount of data had been accessed by 'an individual threat actor' via a third-party, cloud-based shared file drive, and that the attacker had then posted and sold the files. The company's own PSIRT blog downplayed the scale, arguing the actor's 440GB claim was misleading because the drive contained a mix of employee and customer data, some of it duplicates, and said the incident affected only a fraction of one percent of customers.

The breach was notable mostly for who it happened to: a company whose entire product line exists to stop exactly this. Fortinet sells firewalls and security software to tens of thousands of organisations, and its customers had to be told that a vendor trusted with their defensive infrastructure could not keep its own documents locked down. The company said it engaged a third-party investigator, revoked the attacker's access, and warned that the leaked data could be used in social-engineering or phishing attacks against its customers.