In September 2025 SonicWall disclosed that an unauthorized party accessed firewall configuration backups stored in its MySonicWall cloud service. An early statement said fewer than 5 percent of firewalls were in scope. Its October update, after Mandiant's work, says the access affected all customers who used the cloud backup feature.
What was exposed
The files are preference files with the .EXP extension, which hold full device configurations. SonicWall says credentials and secrets in them are encrypted, with AES-256 on Gen 7 and newer firewalls and 3DES on Gen 6, while general configuration details can be read after a simple decode. It warns that having the files could raise the risk of targeted attacks.
Network rules, routes, service layouts and user names are a map of how a company is defended. That is useful to an attacker even when the passwords stay protected.
The timeline
SonicWall's knowledge base page records the dates: first published 17 September 2025, a note added on 24 September to check MySonicWall for changes to the affected list, Mandiant findings confirmed and updated impact lists on 8 October, a note on the Last Download Date field on 9 October, and a credentials reset tool added on 28 October.
The scope change is the lesson in disclosure. Early numbers in an incident are often wrong, and customers should treat a partial scope statement as provisional.
What SonicWall told customers to do
- Log in to MySonicWall and check whether cloud backups exist for your firewalls.
- Open the issue list to see whether serial numbers are flagged. Blank means not at risk.
- Start with devices marked high priority, which have internet facing services enabled, then the lower priority ones.
- Review the Last Download Date. If you do not recognise a download, act immediately.
- Follow the credential reset and remediation playbooks, and review every service that had credentials enabled at or before the backup time.
- Check back periodically, since the affected list can change.
SonicWall notes that customers must complete the updates themselves.
General lessons for any vendor held config
- Know what you store with vendors. A convenient cloud backup is a copy of your network design.
- Treat configuration backups as sensitive. Encryption helps, but metadata and structure remain readable.
- Rotate secrets after exposure even when they were encrypted. Weak algorithms age badly.
- Log downloads of backups and alert on unfamiliar ones.
- Keep the vendor's incident feed in your monitoring, and re-check scope as it changes.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation can help you list the vendors that hold your configuration and track the review. It does not manage firewalls. A free scan is at gold.safeguard.sh/scan.
Quick check
Did SonicWall's scope estimate change?
Yes. The September disclosure said fewer than 5 percent of firewalls were in scope. The October update says all customers using the cloud backup service were affected.
Are the credentials in the backup files readable?
SonicWall says credentials and secrets are encrypted, while general configuration details can be read after a simple decode.
Sources
Last reviewed: 19 October 2026.
