---
title: Security Bulletin:Leakage of Firewall Configuration Data via MySonicWall Cloud Backups
description: SonicWall confirms unauthorized access to some MySonicWall cloud backup files, potentially exposing firewall configuration data (keys, VPN settings, passwords). Review your account, rotate credentials/keys, apply the updated preferences file, and monitor for suspicious activity.
---

[Cybersecurity Blog | RedLegg ](https://www.redlegg.com/blog)

# [Security Bulletin:Leakage of Firewall Configuration Data via MySonicWall Cloud Backups](https://www.redlegg.com/blog/security-bulletinleakage-of-firewall-configuration-data-via-mysonicwall-cloud-backups)

 Written by [RedLegg's Cyber Threat Intelligence Team](https://www.redlegg.com/blog/author/redleggs-cyber-threat-intelligence-team) | 9/17/25 7:54 PM

About:  

The MySonicWall Cloud Backup File Incident exposed firewall configuration backups, leaking sensitive data such as keys, VPN settings, and credentials, raising the risk of targeted attacks.

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

## VULNERABILITIES

## Leakage of Firewall Configuration Data via MySonicWall Cloud Backups

Identifier: MySonicWall Cloud Backup File Incident  
Update: [MySonicWall Cloud Backup File Incident Advisory](https://www.sonicwall.com/support/knowledge-base/mysonicwall-cloud-backup-file-incident/250915160910330) 

Description: An incident has been confirmed where firewall configuration backup files stored in certain MySonicWall accounts were exposed via unauthorized access. These configuration backups contain sensitive information that could make exploitation of the firewalls significantly easier for threat actors (for example, private keys, VPN configuration, passwords). SonicWall has terminated the unauthorized access point, is working with law enforcement and cybersecurity agencies, and is investigating the scope of the exposure. If your MySonicWall account has cloud backups enabled and your firewall serial number is listed in your account with an informational banner, your device may be impacted. The exposure increases risk of targeted attacks, credential abuse, or network compromise.

Mitigation Recommendation:   

- Immediately log into your MySonicWall account and check whether cloud backups are enabled. If yes, verify if your firewall serial number is flagged as impacted.
  
   
- Reset credentials for all local user accounts, especially those stored in backup/preference files, including passwords and TOTP bindings.
  
   
- Update your firewall preferences file with the new version provided by SonicWall; the updated preferences file randomizes local user passwords and resets VPN keys and TOTP bindings.
  
   
- Export your current firewall configuration to a local, secure backup and maintain "golden image" backups offline.
  
   
- If operating in a high-availability setup, schedule the updates during a maintenance window, noting that importing the updated preferences will cause a reboot of the active firewall.
  
   
- Limit access to cloud backup features or disable them if not needed.
  
  Monitor firewall logs and account activity for unusual login attempts, credential change events, or configuration exports/backups.

[View full post](https://www.redlegg.com/blog/security-bulletinleakage-of-firewall-configuration-data-via-mysonicwall-cloud-backups)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RedLegg's Cyber Threat Intelligence Team"
  },
  "dateModified" : "2025-09-17T19:54:11.399Z",
  "datePublished" : "2025-09-17T19:54:11Z",
  "headline" : "Emergency Security Bulletin: Leakage of Firewall Configuration Data via MySonicWall Cloud Backups",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://www.redlegg.com/hubfs/Emergency%20Bulletin%20v2.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.redlegg.com/blog/security-bulletinleakage-of-firewall-configuration-data-via-mysonicwall-cloud-backups",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4675768/logo-red-01.png",
      "width" : 419.66666
    },
    "name" : "RedLegg Cybersecurity Blog"
  }
}
```