Have you been backing up your SoniWall to their cloud?

[Kurt Buff]

https://www.theregister.com/2025/10/09/sonicwall_breach_hits_every_cloud/

"While SonicWall insists the intrusion did not affect other MySonicWall services or customer devices, it's urging administrators to treat the incident seriously. Customers have been told to delete any existing cloud backups, change their MySonicWall credentials, rotate shared secrets and passwords, and recreate new backup files locally rather than in the cloud."

All of your configs, credentials, etc. have been compromised.

Kurt

[Micheal Espinola]

[...] confirms that the attackers successfully accessed data belonging to every customer who had ever used the cloud backup service [...]

So much for less than 5%

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CADy1Ce5n6_9HPygq-S8KAP1qrznqCg-kUvKMN3TcVqHLCQ1cHA%40mail.gmail.com.

--

---

Espi

[Shawn K. Hall]

Maybe only 5% used cloud backup?

-S

> <https://groups.google.com/d/msgid/ntsysadmin/CADy1Ce5n6_9HPyg
> q-S8KAP1qrznqCg-kUvKMN3TcVqHLCQ1cHA%40mail.gmail.com?utm_mediu
m=email&utm_source=footer> .
>
>
>
>
> --
>
>
> ---
> Espi

>
> --
> You received this message because you are subscribed to the
> Google Groups "ntsysadmin" group.
> To unsubscribe from this group and stop receiving emails from
> it, send an email to ntsysadmin+...@googlegroups.com.
> To view this discussion visit

> https://groups.google.com/d/msgid/ntsysadmin/CAAfzEuw8fnXd2jEy
> %3DT3S9jcvPieYx18SZbVPSPHjViYHpV8VAg%40mail.gmail.com
> <https://groups.google.com/d/msgid/ntsysadmin/CAAfzEuw8fnXd2jE
> y%3DT3S9jcvPieYx18SZbVPSPHjViYHpV8VAg%40mail.gmail.com?utm_med
ium=email&utm_source=footer> .
>
>

[Micheal Espinola]

That's a fair point, but I'm skeptical because of the lack of information in the updated incident report. The changelog says:

2025-9-17 8:45 PM PDT: Revised incident disclosure text to clarify scope (<5% of firewalls), encrypted credentials, no known leaks, and brute-force (not ransomware) attack

And yet, where is this clarification of this scope in the incident report itself? 

On top of that, what I particularly love, is that the downloadable PDF version cannot be searched for text even though it's essentially a print of the webpage itself. It's essentially an extended screenshot. You can't even click on the hyperlinks.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/6EEF077B942B4DFDB35A193A3C4A6934%40Firefly.

--

---

Espi