SonicWall has blamed an unnamed, state-sponsored collective for the September break-in that saw cybercriminals rifle through a cache of firewall configuration backups.

The network security vendor said it spotted "suspicious activity" in early September involving the unauthorized downloading of backup firewall configuration files from "a specific cloud environment." The company [1]initially said that "fewer than 5 percent" of its firewall installed base had files accessed, but later [2]admitted that "all customers" who utilized the MySonicWall cloud backup feature were affected

SonicWall said its incident response team quickly called in Google-owned Mandiant, the go-to fixer for when things get ugly. SonicWall has now wrapped up the probe, confirming that the intruders were state-sponsored operators who gained access via an API call to the cloud backup system.

[3]

In [4]an update published this week , SonicWall said the investigation confirmed the intrusion was limited to a cloud-based backup service and did not affect SonicWall's products, firmware, source code, or any customer networks.

[5]

[6]

The activity was confined to an API call used to access those backup files, and had nothing to do with the Akira ransomware campaigns that have been hammering firewalls and edge devices elsewhere on the internet.

In a video statement, SonicWall CEO Bob VanKirk said: "We now know this incident was carried out by state-sponsored threat actors. The malicious activity has been contained and was isolated to our firewall cloud-backup services. There was no impact to customer data or any other SonicWall system."

[7]

SonicWall has not said which nation was behind the incident or provided indicators linking it to any known threat group.

It has taken all remediation actions recommended by Mandiant and would continue to work with the firm and other third parties to harden network and cloud infrastructure. SonicWall stressed that this was not a case of its firewall software itself being compromised but rather a supporting cloud service used to store backups – a subtle distinction, but one that matters when your brand trades on keeping attackers out.

SonicWall has spent the past few months on what it calls a "Secure by Design" modernization push, aimed at tightening product architecture, cloud operations, and internal security practices. VanKirk said the company would use lessons from the incident and community feedback to "continue to improve how we interact with our partners when security issues arise."

[8]'Highly sophisticated' government goons hacked F5, stole source code and undisclosed bug details

[9]Cybercrims claim raid on 28,000 Red Hat repos, say they have sensitive customer files

[10]Cybercrims claim raid on 28,000 Red Hat repos, say they have sensitive customer files

[11]Senator blasts Microsoft for 'dangerous, insecure software' that helped pwn US hospitals

"As nation-state–backed threat actors increasingly target edge-security providers, especially those serving SMB and distributed environments, SonicWall is committed to strengthening its position as a leader for partners and their SMB customers on the front lines of this escalation," the company said.

That confidence may be well-placed, though the breach adds SonicWall to a growing list of security vendors that have learned the hard way that even defensive infrastructure can become a target of geopolitical cyber operations.

[12]

SonicWall insists it has emerged "stronger, more resilient, and even more trusted" from the experience. Customers, one assumes, will hope that's true – and this is the last time their firewall backups become a foreign-policy problem. ®

Get our [13]Tech Resources



[1] https://www.theregister.com/2025/09/18/sonicwall_breach/

[2] https://www.theregister.com/2025/10/09/sonicwall_breach_hits_every_cloud/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aQzUJ_-r-wH-ONwjRnWXiAAAAAI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://www.sonicwall.com/blog/cloud-backup-security-incident-investigation-complete-and-strengthened-cyber-resilience

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQzUJ_-r-wH-ONwjRnWXiAAAAAI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQzUJ_-r-wH-ONwjRnWXiAAAAAI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQzUJ_-r-wH-ONwjRnWXiAAAAAI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2025/10/15/highly_sophisticated_government_hackers_breached/

[9] https://www.theregister.com/2025/10/02/cybercrims_claim_raid_on_28000/

[10] https://www.theregister.com/2025/10/02/cybercrims_claim_raid_on_28000/

[11] https://www.theregister.com/2025/09/11/wyden_microsoft_insecure/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQzUJ_-r-wH-ONwjRnWXiAAAAAI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://whitepapers.theregister.com/