ClosedHighNo fix needed

SonicWall: state actor stole firewall config backups of every cloud-backup customer

SonicWall MySonicWall cloud backup

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Why this severity: Theft of firewall configs (with secrets) from vendor cloud

Started: Sep 17, 2025
Closed: Nov 5, 2025

Follow this incident

Updated Nov 5, 2025

Affected

Fixed in

No fixed release yet

Timeline3

Nov 2025
SonicWall says the investigation is complete and attributes it to a state-sponsored actor
Source
Oct 8, 2025
SonicWall and Mandiant confirm all cloud-backup customers' files were accessed
Source
Sep 17, 2025
SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers)
Source

Advisories3

News & write-ups1

SonicWall: Firewall configs stolen for all cloud backup customersBleepingComputer

Notes & caveats

Sep 17 initial disclosure and November completion dates are approximate; verify on SonicWall's pages.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified