Fortinet, a multinational cybersecurity firm and the world’s seventh largest retail IT company, has confirmed that it’s been hacked, according to reports. The news of this major breach at a company whose business model is built on keeping corporate networks safe is an ominous sign of where digital security is headed now. The company’s data on customers was exposed.
The threat actor who took credit for the breach was going by the name ‘Fortibitch’ and claimed to have stolen some 440 GB of sensitive data from the Fortinet’s server on Microsoft Azure SharePoint. The attacker also posted access credentials to what appeared to be an Amazon S3 bucket containing the stolen data on a hacking forum, as if to offer the now-compromised information to the broader criminal underground.
Fortinet acted quickly, confirming that an unauthorized third party had broken into a ‘third-party cloud-based shared file drive’, and that customer data had been compromised. The company has not yet disclosed the details of the breach, but according to preliminary reports, less than 0.3 percent of its customer base was affected. Fortinet says there is ‘no evidence that any activity, malicious or otherwise, has targeted customers.
After the breach was discovered, Fortinet promptly took steps to minimize the fallout. The firm elaborated on the responses in its incident report, stating that it:
So far, those steps have helped stem the attack; and while Fortinet’s response has reduced the cerberus threat, it is still evaluating the full downstream impact of the breach.
Not only are there more incidents of cyberattacks than ever before, but the scale, frequency, and sophistication of such cyberattacks have grown exponentially over the past several years. For instance, the IBM 2023 Cost of a Data Breach Report put the global average cost of a data breach at an unprecedented $4.45 million, highlighting a persistent financial trend with regard to cyber incidents. All of this:
These statistics support the notion that the risk of cyber attacks is increasing, and even cybersecurity firms are having to evolve and improve their defenses regularly.
That Fortinet – a company in the business of keeping others safe from cyberattacks – fell victim to just such an attack and got hacked was, therefore, doubly alarming and, in its way, representative of a growing trend. In recent years, firms in the business of keeping others safe against cyberattacks have been increasingly falling victim to them. They offer a ripe target for threat actors since sensitive data is held about their own operations, as well as their customers.
These breaches highlight the reality that no organization is completely safe from cyber threats, even those specializing in the defense against them.
Fortinet’s breach teaches the world a valuable yet too infrequently discussed lesson: nobody is immune to cyberattacks, even those leaders in cybersecurity that happen to be Fortinet. This incident highlights several important lessons for the security community.
The breach also might have taken place through a third-party, customized cloud-based file-sharing application, which shows that cloud services are a vulnerable link for many organizational cyber-security frameworks. Companies should use a combination of cloud security, such as data encryption, identity access management (IAM) and multi-factor authentication (MFA).
Conducting security audits for clients is the business of security-research companies, of which Fortinet is just one, but internal audits and penetration testing are also warranted to detect vulnerabilities in their own systems. The Fortinet breach shows that regular security checks – especially of third-party applications and shared workspaces – are a must.
Fortinet’s quick response, including shutting down unauthorized access and notifying relevant authorities, helped mitigate further damage. Rapid incident response is essential in minimizing the impact of a breach, and organizations should ensure they have predefined incident response plans in place.
Fortinet’s quick and open communication about the breach and swift notification of potentially affected customers are correct practices during a crisis of this nature. They are part of what might be called ‘epistemic trust,’ the principles of communication about events that are not entirely under your control. Such communication can serve to sustain or even build trust and may ameliorate the possibility of reputational damage.
As the digital world grows in both quantity and complexity, the digital impact on business, along with digitally enabled crime, is ever-increasing. Cybersecurity organizations have to become more proactive as they strive to protect their own environments and those of their clients. A key element of this proactive stance is threat intelligence. It’s all well and good to build a fortified castle with moats and high walls, but it only becomes really powerful when armed intelligence about the enemy is added to the mix. Threat intelligence is the process of gathering, analyzing, and acting on information about any element that might constitute a future threat, be it natural, malevolent, or accidental in nature. It helps to stay one step ahead of the adversary (threat actor) by using their tactics, techniques, and procedures (TTPs) against them, identifying vulnerabilities and risk mitigation before they can cause significant damage by taking proactive action.
Threat intelligence provides an understanding of the current threat landscape combined with an actionable course of events for organizations. Through ongoing analysis of hacker activity, identifying emerging threats, and then supplying the context, companies can respond to upcoming incidents. Key elements of threat intelligence include:
One of the main takeaways from the Fortinet breach, however, is that threat intelligence can be employed from a prevention standpoint to catch threats early. We can better ride out any cyberattacks if we monitor for threats to bring up the attack surface and employ what we’ve learned from past incidents.
ThreatMon is a next-generation threat intelligence and monitoring platform that gives companies deep insight into threat actor behavior and malicious activity, helping them stay a step ahead of attackers.
ThreatMon enables organizations to:
The breach of Fortinet shows cybersecurity has a few hard lessons to learn. Everyone in this industry needs to adopt a heightened level of paranoia – rigorously using the very best threat intelligence tools available – to stay ahead of the threat. The days of simply reacting to threats, no matter who you are or what you’re defending, are over. You must be hunting in order to stay ahead of the bad guys. You must continuously improve your defenses based on real-time threat intelligence data.
ThreatMon – which employs actionable insights, continuous monitoring for emerging threats, and full incident response for its partners, enabling them to take a proactive stance in protecting themselves against future breaches and minimize the impact of incidents as and when they occur – is one such platform available to organizations that are serious about safeguarding their data and reputation. When the stakes are so high, nothing short of the best practices of threat intelligence will do.
