Secutec and SOCRadar assess the impact in Belgium of a large-scale attack on firewall manufacturer Fortinet
In summary:
- Research by Secutec and SOCRadar reveals how hackers are infiltrating corporate networks on a massive scale, including in Belgium.
- The firewalls of 270 Belgian organizations were compromised in February 2026. Secutec’s investigation revealed that 110 of them are currently still accessible via the internet using the intercepted administrator credentials.
- On half of the firewalls examined, Secutec has already found new accounts created by the hackers themselves.
- Corporate information is being exfiltrated, for which hackers may demand a ransom at a later stage: this is the new ransomware model.
At least 270 Belgian organizations have been affected by the large-scale FortiBleed cyber incident, in which criminals stole access credentials to Fortinet firewalls and are actively exploiting them. This is according to an analysis by Secutec, which mapped the impact in Belgium in collaboration with the Threat Research Unit of SOCRadar, a specialist in darknet monitoring. At present, attackers still have administrator-level control over the firewalls of more than 100 Belgian organizations, leaving their networks exposed.
FortiBleed
FortiBleed is considered one of the largest incidents ever involving a security vendor. Globally, Secutec and SOCRadar have identified more than 75,000 compromised firewalls. Over 110 million login credentials have been intercepted in a large-scale campaign that has been ongoing since early 2026 and is still active today.
The attack exploits the Fortinet partner portal, where IT service providers have access to their customers’ environments. A vulnerability allowed hackers to obtain the login credentials of tens of thousands of partners, enabling them to infiltrate not just a single organization, but an entire chain of customer networks. This explains why the impact spans multiple sectors simultaneously and why even smaller organizations have been affected.
Significant impact in Belgium
The Belgian investigation reveals that the impact is very significant. The stolen login credentials affect organizations across a wide range of sectors, including law firms, local governments, schools, and other service providers. In at least 150 cases, the affected firewalls are still directly accessible via the internet. For 110 of those firewalls, it is still possible to log in using the IT partner’s administrator credentials.
The cause often lies in poor security practices. For example, it appears that multi-factor authentication was not enabled on any of the firewalls examined, while in many cases, IT partners use identical passwords for multiple clients. Furthermore, 85 percent of the affected systems are not running the latest firmware, leaving known vulnerabilities open to exploitation.
Hackers are still active
According to research by the two cybersecurity organizations, FortiBleed demonstrates a clear evolution in the methods used by cybercriminals. “Whereas ransomware attacks used to focus primarily on encrypting data, the focus is now shifting toward stealing and trading access and data. We refer to this as Initial Access Brokerage. In Belgium, hackers have already created new accounts on at least 45 systems, indicating that access is being prepared for sale on the dark web. We’ve observed large-scale data exfiltration at various organizations worldwide,” says Geert Baudewijns, CEO of Secutec.
The operation is linked to a Russian group; it is remarkably well-organized and orchestrated, and on an unprecedented scale. According to the investigation, the attackers gained access via “brute force” by automatically combining large numbers of passwords and usernames. Once inside, they installed FortigateSniffer, which can monitor all network traffic through the firewall and intercept login credentials via dozens of protocols.
The stolen data is then cracked, enriched, and used to penetrate deeper into internal systems, after which sensitive data is systematically stolen. The investigators note that the attackers’ infrastructure is still operational, with new compromises occurring daily.
“FortiBleed illustrates just how vulnerable the current IT services ecosystem has become, where a single weak link can lead to access to hundreds of organizations at once."
Belgian authorities notified
Secutec has since notified the Cybersecurity Center Belgium and European national CERTs. The two companies are urging organizations using Fortinet solutions to take immediate action, including updating systems, enabling multi-factor authentication, and reviewing access and accounts.
“FortiBleed illustrates just how vulnerable the current IT services ecosystem has become, where a single weak link can lead to access to hundreds of organizations at once. We expect these types of large-scale chain attacks to only increase in the coming years,” warns Baudewijns.