Critical Security Alert: SonicWall Cloud Backup Breach

On Friday 10th October, SonicWall confirmed a major security incident affecting all customers using its MySonicWall cloud backup service. Attackers gained access to firewall configuration backup files, which include sensitive data such as encrypted credentials (login details including passwords) and network configurations. While encryption remains in place, possession of these files significantly increases the risk of targeted attacks.

What This Means

These configuration files can reveal critical details about network setups, VPN access, and security policies. If exploited, this could allow attackers to infiltrate networks and compromise systems. SonicWall has urged all customers to take immediate action, including resetting credentials and reviewing firewall configurations.

We are already seeing reports of widespread SonicWall SSL VPN breaches, with attackers using valid credentials to access multiple accounts rapidly.

Our Immediate Response

At AAG IT Services, we acted as soon as the announcement was made. Over the weekend, our engineering team worked tirelessly to reconfigure and secure every SonicWall firewall under our management. This included:

• Resetting all admin passwords and pre-shared keys
• Updating LDAP bind credentials and enforcing MFA
• Reviewing and locking down management access to prevent external threats

A huge thank you goes to Leon Barker, Alex Cromwell, Peter Jennings and Ryan Douce for their efforts.

We’ve followed SonicWall’s official remediation guidance and gone further to ensure your systems remain protected, and have contacted all customers regarding their situation.

What You Need to Do

If you manage your own SonicWall device, check your configurations immediately. SonicWall has published full guidance and tools to help you assess and remediate any risks: View SonicWall’s official advisory

What to Expect Next

Our Service Desk will remain actively engaged in follow-up actions this week. You may notice some disruption, particularly with VPN access, as we complete these security measures. Please bear with us during this critical period, we’re prioritising your security above all else.

If you have any concerns or experience issues, contact our support team or your account manager immediately. We’ll continue to provide updates as more information becomes available.