quovadis
Honorary Master
On September 17, 2025, SonicWall released a knowledge base article detailing the exposure of firewall configuration backup files stored in certain MySonicWall accounts. As of October 8, 2025, the investigation has concluded and SonicWall has updated their advisory accordingly.
While the original SonicWall advisory stated that under 5% of customers using the MySonicWall configuration file backup feature were affected by the incident, the finalized verbiage now specifies that all customers who have used SonicWall’s cloud backup service were affected.
Considering that sensitive credentials are stored within firewall configurations, organizations using the MySonicWall cloud configuration backup service should urgently prioritize resetting credentials on live firewall devices to avoid unauthorized access. SonicWall states that only Gen 7 and newer firewalls individually encrypt credentials and secrets in exported configuration files using AES-256.
SonicWall has indicated that they are now working to contact all affected customers and partners, and have provided instructions on how to definitively check if an organization’s backed up configuration files were affected in this incident.
arcticwolf.com
While the original SonicWall advisory stated that under 5% of customers using the MySonicWall configuration file backup feature were affected by the incident, the finalized verbiage now specifies that all customers who have used SonicWall’s cloud backup service were affected.
Considering that sensitive credentials are stored within firewall configurations, organizations using the MySonicWall cloud configuration backup service should urgently prioritize resetting credentials on live firewall devices to avoid unauthorized access. SonicWall states that only Gen 7 and newer firewalls individually encrypt credentials and secrets in exported configuration files using AES-256.
SonicWall has indicated that they are now working to contact all affected customers and partners, and have provided instructions on how to definitively check if an organization’s backed up configuration files were affected in this incident.
SonicWall Concludes Investigation Into Incident Affecting MySonicWall Configuration Backup Files - Arctic Wolf
On September 17, 2025, SonicWall released a knowledge base article detailing the exposure of firewall configuration backup files stored in certain MySonicWall accounts. As of October 8, 2025, the investigation has concluded and SonicWall has updated their advisory accordingly. While the...
arcticwolf.com