Cases › security breach › LR-2026-0403
Hundreds of FortiGate firewalls compromised by a threat actor using commercial generative AI services (Jan-Feb 2026)
Confirmed Why: 2 independent outlets · 2 independent reports
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, deployer, industry.
Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: more than 600 FortiGate firewalls across 55 countries were breached.
Between January 11 and February 18, 2026, a Russian-speaking threat actor used commercial generative AI services to breach more than 600 FortiGate firewalls in 55 countries. The attacker did not exploit device vulnerabilities; it scanned exposed management interfaces and brute-forced weak, single-factor logins. After gaining access it extracted device configurations and used AI tools to help automate reconnaissance, credential harvesting and movement across networks. In some cases Claude Code was configured to run offensive tools without per-command approval. Amazon learned of the campaign after finding a server hosting its malicious tools, and reported that the attacker moved on when it met patched or locked-down systems. Amazon recommended restricting internet-facing management interfaces, enabling MFA, separating VPN and Active Directory passwords and hardening backup infrastructure.
What happened
What was done
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 1 items from the primary sources
What happened, in order
Not dated in the sources:
- Amazon learns of the campaign after finding a server hosting malicious tools.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The sources do not say whether model refusals or safeguards were tested or failed, so no D-controls are reported.
LR-2026-0403 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON