A large-scale campaign against enterprise network defenses has set off alarms in the cybersecurity world. Researchers report that hackers breached firewalls and VPNs, exposing more than 70,000 credentials.

Firewalls and VPNs are meant to protect a company’s network. When attackers get through them, the damage can spread fast. Here is what was reported, why it matters, and what organizations can do now. For more security news, explore our Cybersecurity section at Jantarax Tech.

What Happened?

According to cybersecurity researchers, attackers ran a large-scale campaign against network edge devices that are exposed to the internet. Specifically, they went after Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.

The campaign reportedly gave attackers access to many organizations around the world. In the process, more than 70,000 credentials were exposed.

The source material does not say exactly how the attackers got in, which organizations were hit, or whether specific software flaws were used. Those details may emerge as investigations continue.

What Are Network Edge Devices?

Network edge devices sit at the border between a company’s private network and the internet. Firewalls and VPN gateways are common examples.

  • A firewall filters traffic and blocks suspicious connections.
  • A VPN lets employees connect securely to company systems from outside the office.

Because these devices face the internet, attackers can probe them directly. If one is compromised, an attacker may reach the network behind it.

What Does “Exposed Credentials” Mean?

Credentials are the login details that prove who you are, such as usernames and passwords. When they are exposed, attackers can try to use them to sign in as real employees.

This is dangerous because a login from a valid account can look normal. Attackers may move through systems, read data, or set up more access without setting off obvious alarms.

Why Is This Breach Serious?

The devices protect sensitive data. Firewalls and VPNs guard company data and secure communications. A breach here weakens the first line of defense.

Remote work depends on them. As more organizations rely on remote access, the security of VPNs matters more than ever.

The attackers may still be active. Reports say the attackers did more than collect credentials. They also tried to compromise some victims further. That suggests an ongoing threat, with hackers possibly still inside some networks.

The reach is global. The campaign reportedly affected organizations worldwide.

Does This Mean These Products Are Unsafe?

Not necessarily. The reports describe a campaign against exposed devices from these vendors. They do not say the products are uniquely unsafe. Widely used products are simply attractive targets because one successful method can work against many victims. Always check the vendors’ official security advisories for details on affected versions and fixes.

What Should Organizations Do Now?

Organizations using the affected firewalls and VPNs are urged to review their security protocols and update their systems. Experts also recommend additional layers of protection. A practical checklist:

  1. Install the latest updates and patches on all firewalls and VPN gateways.
  2. Reset credentials that may have been exposed, starting with admin and VPN accounts.
  3. Turn on multi-factor authentication (MFA) so a stolen password alone is not enough.
  4. Review logs for unusual logins, new accounts, or unexpected configuration changes.
  5. Limit exposure. Restrict management interfaces so they are not open to the whole internet.
  6. Run regular security audits to find weak spots before attackers do.
  7. Prepare an incident plan so your team knows who to call and what to do if you are breached.

Steps 4 to 7 are general best practice, not instructions from the reports.

What Should Employees and Small Businesses Do?

You do not need to be a large company to be at risk. Smaller teams use VPNs and firewalls too. These habits help:

  • Use long, unique passwords and a password manager.
  • Turn on two-step verification for work and personal accounts.
  • Do not reuse passwords across services.
  • Report odd login alerts or password reset emails right away.
  • Be careful with emails asking you to log in or verify your account, since stolen credentials often feed phishing attempts.

A Growing Pattern of Security Incidents

This breach is part of a wider trend of attacks on the systems people rely on every day. See our coverage of the Revolut data breach caused by fake government requests and the TP-Link router ban and state lawsuits, which also highlighted risks in network equipment.

Defenders are also turning to new tools. Anthropic, for example, launched a free AI vulnerability scanner for open-source projects, showing how automation may help find weaknesses faster.

What Happens Next?

As investigations continue, more details should become clear about the scale of the damage and the weaknesses attackers used. Things to watch include:

  • Vendor advisories and patches from Fortinet and Palo Alto Networks.
  • Updates from researchers on how the campaign worked.
  • Reports from affected organizations about what was accessed.
  • Government or industry warnings with guidance for defenders.

Frequently Asked Questions

How many credentials were exposed?
Over 70,000, according to reports.

Which devices were targeted?
Exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs.

Are the attackers still active?
Reports suggest they tried to compromise some victims further, so the threat may be ongoing.

What is the best protection?
Keep devices updated, use multi-factor authentication, restrict exposure, and audit your security regularly.

Should I change my password?
If your organization uses these systems, follow your IT team’s guidance. Changing passwords and enabling MFA is a smart step in any case.

Conclusion

The breach of enterprise firewalls and VPNs shows how critical strong cybersecurity is in a digital world. Updates, MFA, and regular audits will not stop every attack, but they make an organization a much harder target. As investigations continue, staying alert and acting early will matter most.

For more updates, learn about Jantarax Tech or contact our team with tips and feedback.