SonicWall confirmed a state-sponsored attacker breached its customer portal and stole firewall configuration files from every customer using the company's cloud backup service. CEO Bob VanKirk said the attack was contained to the backup system, but security experts warn the stolen files contain sensitive data like encrypted credentials and firewall rules.
The company initially downplayed the breach's scope, claiming it affected less than 5% of customers before walking back that assessment. Critical details remain unclear, including the exact number of impacted customers and how long attackers had access. SonicWall detected suspicious activity in September but hasn't disclosed which nation was responsible.
Source: CyberScoop