The Real Cost of Getting Breached in 2026 — and What Your Business Should Do This Week

---

1. FortiBleed: 73,000 Fortinet VPN Credentials Exposed

A newly discovered data leak, dubbed "FortiBleed," has exposed what appears to be a collection of Fortinet and FortiGate VPN credentials for 73,932 firewall URLs at organizations worldwide. The dataset was surfaced publicly, meaning anyone from opportunistic criminals to nation-state actors can potentially pivot through exposed VPN endpoints into corporate networks.

What this means in dollars: Fortinet SSL-VPN appliances have been a recurring target. The 2024 exploit of CVE-2024-21762 and related FortiOS vulnerabilities led to mass compromise campaigns. Organizations that failed to patch faced not only ransomware but full network takeovers. IBM's Cost of a Data Breach Report places the average breach involving stolen or compromised credentials at approximately $4.65 million USD — and that figure climbs sharply when the initial access vector is an unmonitored VPN appliance that attackers have weeks or months to exploit before detection.

How victims could have saved millions:

• Apply Fortinet security advisories within 48 hours of release — the patches for these CVEs were available before exploitation peaked
• Disable SSL-VPN access for accounts that don't need it, and enforce hardware-bound MFA on every VPN session
• Rotate VPN credentials immediately if your device appears in any credential exposure dataset — check your Fortinet serial numbers against the advisory lists
• Segment VPN access zones so a compromised endpoint cannot reach production, finance, or backup systems

Do this week: Log into your Fortinet console, confirm firmware is on the latest patched release, and verify every VPN user has MFA. If you can't, restrict the VPN to a single jump host.

---

2. ClickFix: Malware Delivery Targeting Australian Infrastructure

The Australian Signals Directorate (ASD) has issued an advisory warning that threat actors are using a social engineering technique called ClickFix to distribute Vidar Stealer malware through compromised WordPress websites, with Australian networks specifically named as targets.

ClickFix works by tricking visitors into believing they need to "fix" a problem on the page — a fake CAPTCHA, a verification prompt, or a broken plugin message. The victim is instructed to copy and paste a command into their terminal or run a script. That command delivers Vidar, an information-stealing trojan that harvests saved browser passwords, session cookies, cryptocurrency wallets, and SSH keys before the attacker ever needs to break through a perimeter.

The cost of an info-stealer infection: Unlike ransomware, Vidar infections are often silent. Credentials are exfiltrated and sold on dark web markets for weeks before a business realizes accounts have been compromised. The median time to identify and contain a data breach globally is 258 days — during which stolen credentials enable follow-on fraud, invoice redirection, and ransomware deployment. BEC (business email compromise) losses tied to stolen credentials averaged $50,000 AUD per incident for Australian SMBs in recent reports, with total losses across reported incidents exceeding hundreds of millions annually.

How victims could have saved millions:

• Block execution of unsigned scripts and macros via group policy or EDR — Vidar cannot install if the initial payload can't run
• Train staff to recognize ClickFix prompts and never copy-paste commands from web pages — this is now an ASD-documented threat pattern
• Audit WordPress sites your business owns or depends on — outdated plugins are the entry point
• Use a password manager with hardware-bound credentials so stolen session cookies can't be replayed

Do this week: Check whether your organization runs any WordPress sites, confirm they're updated, and brief your team: never run a command a website tells you to paste.

---

3. China-Nexus Covert Networks: Supply Chain at Scale

In a joint advisory, the ASD's ACSC, alongside Five Eyes partner agencies, outlined a significant shift in tactics by China-nexus cyber actors who are building covert networks of compromised devices — including SOHO routers, IoT cameras, and network appliances — to use as infrastructure for espionage, pre-positioning, and facilitating other attacks including ransomware.

This is not a single breach. It's a campaign that enables thousands of breaches. Compromised consumer and small-business devices are chained together into proxy networks that attackers use to hide their origin, relay commands, and stage payloads against larger targets. If your business supplies, integrates with, or shares network trust with a compromised device, you become part of the attack chain.

The supply chain cost multiplier: Supply chain compromise breaches are the most expensive category tracked by IBM, averaging $4.55–5.5 million USD per incident — 11–16% higher than the overall average. When attackers pivot through a trusted supplier, the victim organization has often already granted the connection implicit trust, bypassing controls that would otherwise stop an external attacker.

How victims could have saved millions:

• Treat every supplier network connection as untrusted — apply network segmentation and monitoring to vendor and partner links
• Inventory all internet-facing devices, including those managed by third parties; many compromised devices in these campaigns are forgotten appliances no one knew were exposed
• Implement egress filtering so compromised internal devices cannot beacon to unknown command-and-control infrastructure
• Replace end-of-life SOHO routers and IoT devices — these are the primary recruitment targets for covert networks

Do this week: Download the joint advisory, identify any internet-exposed devices on your network (routers, cameras, DVRs, appliances), and apply the listed mitigations.

---

FAQ

Conclusion

The breaches making headlines this month — FortiBleed, ClickFix, and state-sponsored device networks — share a common thread: they exploit gaps in fundamentals, not zero-days. Unpatched VPN appliances, untrained users pasting malware commands, and unmonitored internet-facing devices are not exotic attack vectors. They're the same problems security professionals have been flagging for years, and attackers know most organizations still haven't closed the gaps.

The organizations that avoid the million-dollar losses are not the ones buying the most expensive tools. They're the ones patching on schedule, enforcing MFA, segmenting their networks, and training their people. Every breach in this roundup had a known, documented mitigation available before the damage occurred.

Don't wait for the headline about your business. Visit consult.lil.business for a free cybersecurity assessment and find out exactly where your gaps are before someone else does.

---

References

1. ASD ACSC Advisory — Defending against China-nexus covert networks of compromised devices
2. ASD ACSC Advisory — ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure
3. IBM Cost of a Data Breach Report — 2024 findings and benchmarks
4. BleepingComputer — FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices
5. CISA — Cross-Sector Cybersecurity Performance Goals (CPG) for SMB baseline security