SonicWall data breach (2025): firewall configuration backups for every cloud-backup customer
SonicWall sells firewalls and VPNs. In 2025 attackers took the configuration backups customers had stored in SonicWall’s own cloud, and the company’s estimate of who was affected went from under 5% of customers to all of them in three weeks. This is the running record, with each change dated to SonicWall’s own notice.
Short answer
Was SonicWall hacked?
Yes. In September 2025 SonicWall disclosed that attackers had accessed firewall configuration backup files stored in its MySonicWall cloud backup service. It first said fewer than 5% of firewalls were affected; on 8 October 2025, after an investigation with Mandiant, it confirmed the files of all customers who had used the cloud backup service were accessed.
The files hold firewall settings and credentials; SonicWall says the credentials are encrypted, but the files could make targeted attacks easier. In November 2025 SonicWall’s CEO said the attack was “carried out by state-sponsored threat actors” through an API call to the backup service, and that SonicWall products, firmware, source code and customer networks were not affected. SonicWall has not named a country.
Timeline at a glance
17 Sep 2025SonicWall discloses access to cloud backup files; says under 5% of firewalls. (SonicWall notice)Confirmed
8 Oct 2025Mandiant-led review: backup files of all cloud-backup customers accessed. (SonicWall notice)Confirmed
28 Oct 2025Credentials Reset Tool added to the notice. (SonicWall notice)Confirmed
Early Nov 2025SonicWall attributes the attack to a state-sponsored actor; products and networks unaffected. (The Register)Confirmed
Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
SonicWall incident timeline, in detail
Confirmed = acknowledged by SonicWall, a regulator filing or a court. Reported = credible reporting SonicWall has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Sep – Nov 2025ConfirmedVendor cloud service / config theft
MySonicWall cloud backup files accessed for every cloud-backup customer
What happened. SonicWall’s notice, first published 17 September 2025, said an attacker accessed firewall preference (configuration) backup files stored in MySonicWall’s cloud backup service; a same-day revision put scope at under 5% of firewalls and noted encrypted credentials, no known leak and a brute-force method. On 8 October SonicWall updated the notice with Mandiant’s finding that backup files for all customers who had used the cloud backup service were accessed. In November it attributed the activity to a state-sponsored actor using an API call to the backup service.
Impact. Configuration files contain network layout, users, services and encrypted credentials. SonicWall flagged affected serial numbers in MySonicWall by priority, and published a remediation playbook, online analysis tool and credentials reset tool. It said products, firmware, source code and customer networks were not affected.
Scope: under 5% of firewalls (17 September) became all cloud-backup customers (8 October). Both statements are SonicWall’s; the second replaces the first.
Method: the first revision said brute force; the November update describes an API call to the backup environment. SonicWall has not explained how the API was reached.
Attribution: SonicWall says state-sponsored and names no country. Some outlets linked the incident to an older SonicWall CVE; SonicWall has not.
The pattern across the record
The security vendor’s cloud became the target
Customers stored firewall backups in the vendor’s cloud for convenience. That concentrated thousands of network blueprints in one place an attacker could query.
Scope estimates move
The first number in a vendor incident is rarely the last. Plan your response on the worst credible scope, not the first figure published.
What it means for SonicWall customers — and what to do
If you ever used MySonicWall cloud backup, assume the configuration of your firewall was copied and treat the credentials in it as exposed.
1.Check MySonicWall for flagged devices
Look under the issue list for your serial numbers and the “Last Download Date”; handle “Active – High Priority” devices first.
2.Reset every credential in the config
Local admin and user passwords, VPN pre-shared keys, LDAP/RADIUS bind accounts, API keys and any service with credentials enabled at backup time.
Yes. Attackers accessed firewall configuration backup files in SonicWall’s MySonicWall cloud backup service in 2025. SonicWall confirmed on 8 October 2025 that files for all customers who used cloud backup were accessed, and in November attributed it to a state-sponsored actor.
What data was exposed in the SonicWall breach?+
Firewall configuration (preference) backup files, which include network settings, users and encrypted credentials. SonicWall said its products, firmware, source code and customer networks were not affected.
How many SonicWall customers were affected?+
Every customer who had used the MySonicWall cloud backup service, per SonicWall’s 8 October 2025 update. Its earlier estimate was under 5% of firewalls.
Who hacked SonicWall?+
SonicWall says a state-sponsored threat actor, based on its investigation with Mandiant. It has not named a country.
What should SonicWall customers do?+
Check MySonicWall for flagged serial numbers, reset every credential that was in the firewall configuration (admin, VPN keys, directory bind accounts, API keys), and keep management interfaces off the internet.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by SonicWall. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout