Government IT credentials tied to Britain's Foreign, Commonwealth and Development Office have surfaced in a dark web marketplace, part of a sprawling criminal operation that security researchers say has already touched organizations in nearly 200 countries. The discovery has renewed urgency around a single question echoing through cybersecurity circles today: how deep does this cyberattack today actually reach into UK government systems.
The credentials were pulled from a campaign researchers have nicknamed Fortibleed, an ongoing effort to harvest and resell login details for Fortinet firewalls and VPN gateways. Unlike a conventional data breach tied to one company or one moment in time, Fortibleed works more like a slow-moving net, recycling passwords exposed in earlier hacks and quietly testing them against internet-facing devices until it finds ones that still work.
What makes this cyberattack today different from routine password leaks is the nature of what was stolen. Rather than ordinary email logins, the exposed FCDO credentials reportedly include privileged access to firewalls and VPN gateways, the kind of access that, if genuine, could open a door straight into sensitive government networks rather than a single inbox.
What Investigators Found in the Fortibleed Dataset
Security researchers tracking the campaign say the underlying database now contains more than 30,000 verified Fortinet usernames and passwords pulled from organizations across 194 countries. The credentials were not obtained through a new software flaw, according to Fortinet, but through a slower and less glamorous method: attackers reusing old, leaked passwords and running automated guessing attempts against devices that lack multi-factor authentication.
UK Government and Local Council Accounts Identified
Among the accounts flagged in the dataset are IT staff credentials tied to British embassies in Thailand and Mauritius, according to reporting by the Telegraph, along with logins belonging to employees at Derbyshire and Waltham Forest councils. The presence of embassy-level IT access alongside local council credentials suggests the campaign's reach extends well beyond a single department, touching both national diplomatic infrastructure and everyday local government operations.
A Six-Figure Price Tag on Dark Web Forums
A threat actor operating under the alias SantaAd is reportedly offering access to the stolen credentials for as much as 60,000 dollars, or roughly 44,000 pounds, the Telegraph reported. That price point has fueled concern among security professionals that the access could be resold again, this time to ransomware operators looking for an entry point into UK government or critical infrastructure networks rather than simply browsing the stolen data.
Beyond Government: Energy, Health and Pharmacy Networks Also Exposed
The FCDO and council accounts are not the only sensitive entries in the exposed dataset. Credentials tied to energy companies, NHS organizations, pharmacies and medicine suppliers reportedly appear alongside the government logins, pointing to a campaign that has quietly spread across critical UK sectors well beyond Whitehall.
Why This Cyberattack Today Is Raising National Security Questions
Volodymyr "Bob" Diachenko, the researcher credited with first uncovering the Fortibleed database, told the Telegraph the exposure could expose sensitive systems well beyond a single department. He said the stolen logins could provide access to core networks within the Foreign Office, and that other government departments may also have been affected.
That assessment has prompted a wave of scrutiny, but not everyone in the security community agrees on how serious the intrusion actually is.
Researchers Urge Caution Around Inflated Claims
Dray Agha, senior manager of security operations at Huntress, cautioned that the scale of the breach may be overstated by the criminals responsible. He suggested the attackers likely gained only peripheral access to UK systems, and that their public claims are probably exaggerated to boost the perceived value of the stolen data and their own reputation among other cybercriminals.
That skepticism echoes earlier analysis from security researcher Kevin Beaumont, who wrote on his blog that the operation looks more consistent with financially motivated cybercriminals than a state-sponsored campaign, even though some of the recycled credentials reportedly trace back to a known Russian ransomware group. Russian-language code was reportedly identified within the attackers' tools, though no confirmed link to the Russian state has been established.
Hacktivists and Cybercriminals Are Increasingly Overlapping, NCSC Warns
The UK's National Cyber Security Centre has not attributed Fortibleed to any specific actor, but the agency has flagged a broader trend worth watching: the blurring line between politically motivated hacktivists and profit-driven cybercriminals, groups that increasingly share tools, techniques and even stolen data.
What the NCSC Is Telling Organizations to Do Now
Last month, the National Cyber Security Centre issued guidance urging organizations running Fortinet firewalls and VPN products to audit their systems, check for signs of compromise, and isolate any device suspected of being affected. That advice has taken on new weight following confirmation that FCDO-linked credentials appear in the exposed dataset.
A Fix That Has Nothing to Do With New Software
Because Fortibleed relies on recycled passwords and brute-force guessing rather than an unpatched vulnerability, the most effective defense is largely procedural rather than technical. Security teams are being advised to prioritize:
| Action | Why It Matters |
|---|---|
| Enforce multi-factor authentication on all VPN and firewall logins | Blocks reused passwords from working even if they are correct |
| Force password resets across Fortinet-connected accounts | Neutralizes credentials already circulating in the Fortibleed database |
| Audit device logs for unusual login attempts | Helps identify whether an account has already been tested or accessed |
| Isolate any device showing signs of compromise | Prevents lateral movement into wider networks |
The Bigger Picture for UK Cybersecurity
Even if some claims tied to this cyberattack today prove exaggerated, the underlying pattern is one UK security officials have been warning about for months: a global credential-harvesting operation that does not need a new vulnerability to succeed, only old passwords that were never changed and devices that were never locked down with multi-factor authentication. That combination, researchers say, is what continues to make Fortibleed a live threat rather than a closed incident.
This story is developing, and further updates are expected as the National Cyber Security Centre and affected organizations continue their investigation.
Reporting from the Telegraph contributed to this article.
