FortiBleed and the Maritime Credential Problem No One Wants to Own
What 86,000 Leaked Fortinet Logins Reveal About Maritime Cyber Hygiene
July 13, 2026 | By Ron Frechette | Founder & Managing Director | CyberSurv
Last week, Cydome’s threat-intelligence unit published a number that should stop every FSO, CySO, and IT director in the maritime industry mid-scroll: more than 86,000 exposed administrator credentials tied to Fortinet firewalls and SSL-VPN gateways, spanning thousands of organizations across 194 countries.
More than 250 of those organizations are maritime firms. Most are shipowners or ship management companies. Cydome also identified 703 satellite-linked IP addresses tied to maritime communications providers sitting inside the exposed dataset.
Here’s the part that should really get your attention. This wasn’t a zero-day. It wasn’t a nation-state exploit chain nobody could have anticipated. It was old passwords that never got changed.
What FortiBleed Actually Is
Fortinet’s FortiGate firewalls and SSL-VPN gateways used to store saved login credentials with a weak hashing algorithm. Fortinet upgraded that algorithm between late 2024 and mid-2025. Good move. But the legacy hash file was never deleted.
Attackers found it. They brute-forced it with modern GPUs, a job that used to be hard and now isn’t. Then they took the recovered credentials and started testing them against live, internet-facing systems.
The name the industry is now using for this campaign is FortiBleed. It’s not a new vulnerability in the traditional sense. It’s a cleanup step that never happened, discovered and exploited at scale.
The Maritime Numbers Are Worse Than They Look
Of the impacted maritime organizations, 41.5% are shipping and freight operators, 31.2% are offshore contractors and service firms, 10.7% are shipyards handling newbuild and repair work, and 6.7% are port authorities and logistics organizations. That’s not a back-office IT problem. That’s the operational core of the industry.
Two other figures stand out. Eighty-seven percent of the exposed Fortinet devices still had internet-facing management interfaces enabled. Sixty-three percent of the leaked credentials were default or built-in administrator accounts that had never been renamed.
Translation: a large share of the organizations affected likely don’t know it yet. This isn’t the kind of exposure that trips an alarm. It sits quietly until someone with the right credentials decides to use them.
This Is a Hygiene Failure, Not a Technology Failure
I spent a career in the Coast Guard learning that a completed inspection checklist and an actually secure vessel are two different things. FortiBleed is the cyber equivalent. Fortinet shipped a fix. The vulnerability, in the narrow sense, was patched. But nobody went back and verified that the old file, the old credentials, and the old exposure were actually gone.
That gap between “we patched it” and “we verified it’s closed” is where most real-world incidents live. It’s also exactly the gap that a Cybersecurity Assessment under 33 CFR Part 101, Subpart F is designed to surface: internet-facing management interfaces that shouldn’t be internet-facing, default credentials that were never rotated, and administrator accounts nobody has reviewed in years.
Regulation didn’t cause this exposure. But an organization that treats its Subpart F assessment as a one-time compliance exercise, rather than an ongoing operational discipline, is exactly the kind of organization that ends up in Cydome’s dataset.
There’s also an OT dimension worth naming directly. Firewalls and VPN gateways aren’t just IT plumbing on a ship or at a terminal. They’re frequently the boundary between shore-based networks, satellite communications systems, and the operational technology that keeps cargo moving. A compromised administrator account on that boundary isn’t just a data exposure risk. It’s a potential path into the systems that manage navigation support, cargo handling, and terminal operations.
What CISA and Cydome Are Telling Organizations to Do Right Now
Cydome co-founder and VP of R&D Alon Ayalon put it plainly: organizations should terminate active administrator and VPN sessions, reset passwords, enable multi-factor authentication, and investigate their systems for signs of unauthorized access. The Cybersecurity and Infrastructure Security Agency has echoed the same guidance.
That’s the right immediate response. But FortiBleed is also a reminder that credential hygiene isn’t a project you finish. It’s a discipline you maintain. Devices get provisioned, contractors get temporary access, firmware gets upgraded, and somewhere in that churn, an old account or an exposed interface gets left behind. Without a recurring process to catch it, it stays there until someone else finds it first.
That recurring process is exactly what our RiskGuard 365℠ Cyber Hygiene Program is built for. Instead of a snapshot assessment once a year, RiskGuard 365 keeps eyes on the fundamentals continuously: exposed management interfaces, stale credentials, unpatched systems, and the kind of quiet configuration drift that turned a Fortinet patch note into an 86,000-credential breach dataset.
Final Thoughts
FortiBleed will not be the last incident that starts with “the vendor already fixed this.” Vulnerabilities get patched. Legacy files, orphaned accounts, and forgotten management interfaces do not clean themselves up. Someone has to go looking.
Maritime organizations carry extra exposure here because so much of the fleet depends on remote, satellite-linked connectivity to shore-based systems. A credential leak that would be a headache for a land-based company can become an operational safety issue when it touches a ship management platform or a satellite communications gateway.
The lesson isn’t complicated. Patching is necessary. It has never been sufficient. The organizations that stay ahead of incidents like this one are the ones that verify, on a recurring basis, that yesterday’s fix didn’t leave a door open.
Let’s Explore What’s Possible
Whether your organization needs to confirm it wasn’t caught up in the FortiBleed exposure or wants a clear-eyed look at where similar gaps might be hiding, we’d welcome the opportunity to talk.
CyberSurv helps maritime organizations strengthen cybersecurity, improve operational resilience, and prepare for regulatory compliance through our Maritime Cybersecurity Assessment, RiskGuard 365℠ Cyber Hygiene Program, Penetration Testing, and Security Leadership Program (SLP℠). For organizations looking to close the gap between “patched” and “actually secure,” RiskGuard 365 is where that work happens continuously, not just once a year.
If your team hasn’t confirmed your exposure to FortiBleed, or if it’s simply been a while since anyone checked what’s still sitting exposed on your network, let’s start the conversation.
