Hackers get their hands on SonicWall firewall backups: users urged to reset credentials

SonicWall has disclosed a data compromise affecting cloud backups for under 5% of its firewall install base, where hackers used brute force to access preference files containing encrypted credentials and sensitive network configuration data. This incident, which prompted a CISA alert, significantly increases the risk of future exploitation despite the encryption, as attackers could potentially decrypt or misuse the information. SonicWall is advising affected customers to immediately reset credentials and update firmware, while cybersecurity firms concurrently warn of increased ransomware activity, such as Akira, targeting SonicWall devices through other existing vulnerabilities, highlighting a broader security concern for institutional users of their products.

Analysis

SonicWall has confirmed a data compromise resulting from a brute-force attack on its MySonicWall.com web portal, impacting cloud backups for what it states is 'fewer than 5%' of its firewall customer base. While the compromised preference files contained encrypted credentials, they also included sensitive network configuration data and other information that, according to the US CISA, could be leveraged by malicious actors to gain access to customer firewall devices. This elevates the risk of future exploitation, a concern echoed by Kudelski Security. The incident's severity is compounded by concurrent warnings from security firm Arctic Wolf about a broader, ongoing ransomware campaign by groups like Akira, which has been exploiting other SonicWall vulnerabilities since at least July 2025. This pattern suggests that SonicWall's infrastructure is a persistent target for threat actors, creating significant operational and reputational risk not only for the company but also for its extensive institutional client base, which must now undertake immediate remediation including credential resets and firmware updates.

Key Decisions for Investors

• Investors should immediately conduct due diligence on portfolio companies to determine their exposure to SonicWall products and confirm whether they have implemented the vendor's mandated mitigation measures to prevent network compromise.
• The incident may create a market share opportunity for SonicWall's competitors in the network security space, suggesting a review of publicly-traded rivals in the firewall and VPN market who could benefit from potential customer churn.
• This event reinforces the investment thesis for cybersecurity firms specializing in advanced threat detection, identity and access management, and incident response, as enterprises are likely to increase spending to counter persistent and sophisticated supply-chain attacks.