Romania security agencies targeted in global Fortinet cyberattack

Romanian intelligence services and the Special Telecommunications Service (STS) are among the entities affected by a large-scale cyberattack targeting Fortinet and Palo Alto Networks security equipment. An investigation reveals that a hacking group known as ‘k0t’ operated between October 22, 2025, and July 9, 2026, extracting over 70,000 sets of credentials and access information globally.

In Romania, tens of millions of euros have been spent on Fortinet solutions, including FortiWeb and FortiGate products, which are utilized by ministries, local administrations, military structures, and energy sector operators. While the exact extent of the compromise within Romanian institutions remains unknown, access data for various public and private servers is reportedly being traded on the dark web.

Technical vulnerabilities, such as CVE-2025-64446 affecting FortiWeb, allowed for administrative operations without standard authentication. Attackers also employed brute-force methods against FortiGate devices to copy configurations containing sensitive internal connection data. Fortinet's regional director acknowledged serious security issues regarding the equipment but did not confirm if Romanian intelligence services had been notified.