Morocco warns institutions after massive data leak exposes thousands of devices worldwide

Morocco’s national cybersecurity authorities have warned that several Moroccan institutions may be affected by a massive global data leak known as “FortiBleed,” which has exposed sensitive credentials linked to internet-connected security devices manufactured by Fortinet.

In a security advisory issued under reference number 65471806/26, the Moroccan Computer Emergency Response Team (maCERT), operating under the General Directorate for Information Systems Security within the National Defense Administration, said the breach affects Fortinet firewall devices and SSL VPN gateways used by organizations worldwide.

According to the advisory, approximately 75,000 devices across nearly 200 countries have been impacted, including systems belonging to Moroccan public and private institutions.

The agency urged organizations to take immediate preventive measures, warning that the leaked data includes valid administrator usernames and passwords, as well as credentials used to access virtual private networks (VPNs).

Cybersecurity officials said attackers obtained the information by extracting configuration files from internet-facing FortiGate devices and then cracking password hashes offline, without needing direct access to targeted networks.

Authorities warned that the exposed credentials could allow attackers to gain unauthorized access to internal networks, move laterally across systems, compromise Active Directory environments, deploy ransomware, or steal sensitive data.

To mitigate the threat, maCERT called on affected organizations to verify whether their systems appear in publicly available breach databases using tools recommended in the advisory.

The agency also urged administrators to immediately reset all passwords associated with administrative accounts and VPN access points.

In addition, authorities recommended enabling Fortinet’s strengthened PBKDF2 password-hashing mechanism available in recent versions of FortiOS, including versions 7.2.11, 7.4.8 and 7.6.1.

The advisory noted that the enhanced encryption method is not activated automatically after software updates and requires administrators to log in at least once or have passwords manually reset by a super administrator.

Moroccan cybersecurity officials also stressed the importance of enforcing mandatory multi-factor authentication (MFA) for all administrative access and VPN connections.

Other recommendations included removing public internet access to FortiGate management interfaces and conducting continuous monitoring of system logs for suspicious activity, such as logins outside working hours, unauthorized account creation, or unexplained configuration changes.

Separately, cybersecurity researcher Badr Bellaj said in a post on LinkedIn that dozens of Moroccan companies and institutions appear among the victims of the FortiBleed campaign. He urged organizations to comply with the security measures recommended by Morocco’s information systems security authorities.

The warning comes amid growing concerns over cyberattacks targeting critical infrastructure and enterprise networks worldwide, with leaked administrative credentials increasingly becoming an entry point for ransomware operators and data theft groups.