Russia

Russian Hackers FortiBleed Steal UK Government Logins

Is the U.K.'s cyber crisis caused by poor password hygiene or a relentless Russian offensive?

Published JUL 7

Russian Hackers FortiBleed Steal UK Government Logins

Story

Image credit: Timon Schneider/SOPA Images/LightRocket/Getty Images

The Facts

A cyber campaign dubbed FortiBleed has compromised more than 80,000 Fortinet firewalls across 194 countries since at least February 2026, with security firm SOCRadar verifying a database of over 86,644 stolen login credentials being sold on dark web forums for up to $60,000.
United24 Media
Insurance Business America
Stolen credentials include accounts belonging to Foreign Office staff at British embassies in Thailand and Mauritius, as well as local government workers in Derbyshire and Waltham Forest. Cybersecurity researcher Volodymyr Diachenko, who first identified the breach, said the data provided access to "core networks" within the Foreign Office.
Insurance Business America
Caliber.az
The NCSC issued an urgent alert on July 5 confirming a brute force attack on Fortinet firewall and VPN systems, directing organizations to audit networks and isolate breached devices. Fortinet confirmed FortiBleed exploits poor password hygiene rather than a new product vulnerability.
Insurance Business America
SOFX
Credentials linked to NHS organizations, energy providers and pharmaceutical suppliers are among those exposed. Dr. Saif Abed, a former NHS doctor and cybersecurity expert, warned the breach mirrors a June 2024 ransomware attack on pathology supplier Synnovis that cancelled more than 1,000 operations and 2,000 appointments.
Insurance Business America
Firstpost
The underlying code of the FortiBleed exploit is written in Russian, though no direct evidence of Russian state involvement has been established. GCHQ Director Anne Keast-Butler has warned of tightening ties between Russian intelligence services and proxy cyber actors targeting British networks.
United24 Media
Ukrainian National News
A separate Russian cyber operation attributed to APT28, also known as Fancy Bear and linked to GRU Military Unit 26165, used DNS hijacking on vulnerable routers to harvest login credentials. The NCSC first flagged the campaign on April 7, 2026, with Lumen's Black Lotus Labs identifying at least 18,000 victims across 120 countries.
SOFX
NCSC UK

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Government-critical narrative

The FortiBleed breach exposed 80,000 firewalls across 194 countries because basic password hygiene was ignored — no MFA, recycled credentials, default logins left unchanged. NHS data, Foreign Office logins and local government accounts were all sitting wide open for the taking. Underfunded public sector IT created the vulnerability, and a proposed ransomware payment ban would strip those same bodies of their last real recovery option.

Insurance Business America

Anti-Russia narrative

Russia's APT28 is relentlessly hammering U.K. critical infrastructure, democratic institutions and supply chains in a daily hybrid war that spans cyberspace to the seabed, with Western intelligence agencies attributing this latest credential theft campaign to the Russia-linked Unit 26165. Waiting for a direct hit before treating cybersecurity with urgency is a losing strategy against an adversary this determined.

Pro-Russia narrative

Once again, Russia is being cast as the likely culprit before any evidence proves direct Kremlin involvement. Even British officials acknowledge no state link has been established, yet accusations echo past cases that relied on speculation rather than proof. Instead of fueling another cycle of politicized blame, London should present verifiable evidence or pursue the cyber cooperation it has previously rejected.

Russian Embassy in the UK on X

TASS