# SonicWall: state actor stole firewall config backups of every cloud-backup customer · pwn.watch

> SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Page: https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: SonicWall MySonicWall cloud backup
- Started: 2025-09-17 · closed: 2025-11-05
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025/feed.xml
- JSON Feed: https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025.json
- This file: https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025/llms.txt

## Updates (newest first)
- 2025-11: SonicWall says the investigation is complete and attributes it to a state-sponsored actor (https://www.sonicwall.com/blog/cloud-backup-security-incident-investigation-complete-and-strengthened-cyber-resilience)
- 2025-10-08: SonicWall and Mandiant confirm all cloud-backup customers' files were accessed (https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/)
- 2025-09-17: SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers) (https://www.sonicwall.com/support/notices/mysonicwall-cloud-backup-file-incident/kA1VN0000000RoD0AU)

## Fix brief
# Security brief: SonicWall: state actor stole firewall config backups of every cloud-backup customer

Source: https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025 · status: closed (closed Nov 5, 2025) · severity: high · updated Nov 5, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Severity detail: Theft of firewall configs (with secrets) from vendor cloud

- Product: SonicWall MySonicWall cloud backup

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Nov 2025: SonicWall says the investigation is complete and attributes it to a state-sponsored actor
- Oct 8, 2025: SonicWall and Mandiant confirm all cloud-backup customers' files were accessed
- Sep 17, 2025: SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers)

## Advisories
- [MySonicWall Cloud Backup File Incident](https://www.sonicwall.com/support/notices/mysonicwall-cloud-backup-file-incident/kA1VN0000000RoD0AU) (SonicWall)
- [Cloud Backup Security Incident Investigation Complete](https://www.sonicwall.com/blog/cloud-backup-security-incident-investigation-complete-and-strengthened-cyber-resilience) (SonicWall)
- [MySonicWall cloud backup file incident](https://www.ncsc.govt.nz/alerts/mysonicwall-cloud-backup-file-incident/) (NCSC NZ)

## Write-ups & news
- [SonicWall: Firewall configs stolen for all cloud backup customers](https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/)

## Caveats
Sep 17 initial disclosure and November completion dates are approximate; verify on SonicWall's pages.

---
Machine-readable: https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.