Fortinet data breach (2024): customer files taken from a third-party cloud file drive
Fortinet makes FortiGate firewalls and the FortiSIEM and FortiAnalyzer logging products. In September 2024 it confirmed that someone had taken files from its instance of a third-party cloud file-sharing service. This page separates Fortinet’s own statement from the attacker’s claims about size and ransom.
Short answer
Was Fortinet hacked?
Yes. On 12 September 2024 Fortinet said an individual gained unauthorised access to “a limited number of files” stored on Fortinet’s instance of a third-party cloud-based shared file drive, which included limited data relating to “less than 0.3%” of its customers. Fortinet said it was contacting affected customers.
Fortinet said the incident did not involve encryption, ransomware or access to its corporate network, and that its operations, products and services were not affected. The 440GB figure comes from the attacker, who posted on a hacking forum as “Fortibitch”; The Register reported the attacker said Fortinet refused a ransom demand.
Timeline at a glance
12 Sep 2024Attacker “Fortibitch” posts what it claims are 440GB of Fortinet files. (The Register)Unverified claim
12 Sep 2024Fortinet confirms unauthorised access to files on a third-party cloud drive; under 0.3% of customers. (Fortinet notice)Confirmed
13 Sep 2024Attacker says Fortinet refused to pay a ransom; Fortinet did not file an 8-K. (The Register)Reported
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Fortinet incident timeline, in detail
Confirmed = acknowledged by Fortinet, a regulator filing or a court. Reported = credible reporting Fortinet has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Sep 2024ConfirmedThird-party cloud storage / data theft
Customer files taken from Fortinet’s third-party cloud file drive
What happened. Fortinet’s notice of 12 September 2024 says an individual gained unauthorised access to a limited number of files stored on Fortinet’s instance of a third-party cloud-based shared file drive, including limited data related to less than 0.3% of Fortinet customers. Fortinet said it terminated the access, notified law enforcement and was communicating directly with affected customers.
Impact. Fortinet said no data was encrypted, no ransomware was deployed, its corporate network was not accessed and its operations, products and services were not impacted. TechCrunch estimated from Fortinet’s customer count that 0.3% would be at least 1,500 customers; Fortinet did not give a number.
Attacker claims 440GB from Azure SharePoint and a refused ransom
What happened. A forum user calling themselves “Fortibitch” claimed to have 440GB of Fortinet files from its Azure SharePoint, and said it had asked Fortinet for a ransom that Fortinet refused, per The Register.
Impact. Fortinet has not confirmed the size, the platform or the ransom demand. It said the incident was not material and did not file a Form 8-K.
Size: 440GB is the attacker’s figure; Fortinet said only “a limited number of files”.
Customers affected: Fortinet said under 0.3%; TechCrunch’s “at least 1,500” is its own estimate from Fortinet’s customer count, not a Fortinet figure.
Where the files sat: Fortinet said a third-party cloud-based shared file drive. The attacker’s post referred to Azure SharePoint, and The Register also relayed a claim involving an open Amazon S3 bucket. Fortinet has not named the service.
The pattern across the record
The data breach and the product bugs are different stories
Fortinet appears often in security news because attackers exploit vulnerabilities in FortiGate and other customer-run devices. Those are flaws in products, not breaches of Fortinet. The 2024 file-drive theft is the confirmed incident at Fortinet itself.
File shares hold what customers send
Customer data on a vendor’s shared drive is often configs, logs and diagnostics sent during support. That is the exposure to plan for.
What it means for Fortinet customers — and what to do
If Fortinet contacted you, assume the files it held about you were taken. If it did not, Fortinet says your data was not in scope, but it is still worth checking what you have sent it.
1.Rotate secrets in anything you sent Fortinet
Device configs, debug bundles and FortiSIEM or FortiAnalyzer logs shared with support can contain passwords, pre-shared keys and API tokens. Rotate them, verifying the new value before revoking the old.
Yes. In September 2024 Fortinet confirmed that an individual accessed a limited number of files on its instance of a third-party cloud file drive, including limited data on under 0.3% of its customers.
How much data was stolen from Fortinet?+
Fortinet has not said. The 440GB figure comes from the attacker who posted the data on a hacking forum; Fortinet described “a limited number of files”.
Were Fortinet products or FortiGate devices affected?+
No. Fortinet said its operations, products and services were not impacted and its corporate network was not accessed.
Did Fortinet pay a ransom?+
The attacker said it demanded a ransom and Fortinet refused, per The Register. Fortinet’s notice does not mention a ransom.
What should Fortinet customers do?+
If notified, ask which data was involved and rotate secrets in any configs or logs you sent Fortinet. Either way, keep patching FortiOS and FortiSIEM on their own schedule.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Fortinet. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →