Fortinet firewalls breached: what Italian SMEs are risking

The Fortinet firewall attack: the story of a known vulnerability

On June 17, 2026, TechCrunch reported a story with global reach. A Russian-speaking cybercriminal group reportedly compromised tens of thousands of Fortinet firewalls and VPNs. The targets include large companies around the world. Yet the most worrying detail isn't the scale of the attack. It's the method.

The attackers used known credentials: passwords that had been exposed before or never changed. This is not a sophisticated zero-day exploit. It's a basic technique applied at scale. That means the vulnerability isn't in the Fortinet product itself, but in how system administrators manage credentials.

So the scope of the risk grows enormously. It's not only multinationals with complex infrastructure that are at risk. Italian SMEs that use Fortinet devices to protect their networks are potentially exposed too.

Why Italian SMEs can't ignore this signal

Fortinet is one of the most widely used network security vendors in the world. In Italy, Fortinet firewalls and VPNs are widely adopted by manufacturers, professional firms, retailers and logistics companies. The installed base is significant in the Italian business landscape as well.

The structural problem is well known: SMEs often buy perimeter security devices and configure them once. After that, they rarely update the firmware or rotate access credentials. This creates a permanent window of vulnerability. Default credentials, or those leaked in earlier breaches, are easy to find on the dark web.

On top of that, many Italian SMEs expanded VPN access during and after the mass remote-work period of 2020-2022. As a result, there are now active remote accesses that aren't monitored as closely as they should be. Every unattended access is a potential entry point for an attacker.

According to Gartner's cybersecurity research, identity and access management remains one of the most neglected weak spots in mid-sized organizations. Similarly, the McKinsey Global Institute points out that most successful attacks exploit known vulnerabilities, not novel exploits.

The immediate impact on business operations

A compromised firewall isn't just a technical problem. It's a direct threat to business continuity. With unauthorized access to the perimeter network, an attacker can move laterally inside the infrastructure. From there, they can reach ERP systems, customer databases, accounting archives and internal communication tools.

For Italian SMEs working in B2B in particular, a breach like this can have serious consequences. Business client data is often covered by confidentiality agreements. A data leak can therefore mean reputational damage, lost contracts and potential GDPR penalties.

Even so, many companies underestimate the risk until they suffer an incident themselves. This reactive approach is expensive. According to industry estimates, the average cost of a data breach for a European SME exceeds €150,000, counting downtime, remediation and commercial impact.

What to do now: priority actions for Fortinet users

Responding to this kind of threat doesn't take extraordinary investment. It takes operational discipline and a methodical review of your existing configurations. Here are the most urgent actions.

• Immediate credential audit: make sure no admin account uses default passwords or credentials exposed in previous breaches. Tools like HaveIBeenPwned are a good starting point.
• Firmware update: Fortinet regularly releases security patches. Check the installed version and apply available updates without delay.
• Review of active VPN access: disable all VPN accounts that are no longer needed. Every unused access is a residual risk.
• Enable two-factor authentication (MFA): MFA drastically reduces the risk of unauthorized access, even when credentials are compromised.
• Access log monitoring: set up an alerting system for unusual access or repeated failed login attempts.

These measures don't replace a structured cybersecurity strategy. They are, however, the minimum acceptable level of protection for any SME that handles sensitive data.

The work that's never done: security is a process, not a product

The most common mistake we at SHM Studio see in Italian SMEs is treating IT security as a one-time purchase. You buy the firewall, install it, forget it. In reality, security is an ongoing process that requires periodic reviews, constant updates and staff training.

In this context, AI-driven digital transformation introduces new attack surfaces. Every new digital tool you adopt, whether a cloud CRM, an API integration or an automation system, widens the perimeter you need to protect. That's why security has to be built into your digital strategy from the design stage.

For SMEs investing in their web presence and digital marketing, the underlying technology infrastructure must be solid. A company website or a Google Ads campaign that converts well is worth nothing if your internal systems are vulnerable to a breach.

Outlook: cyber risk for SMEs in 2027-2028

The outlook for the next two years isn't reassuring. The attack surface of SMEs will keep expanding. The growing adoption of SaaS tools, integration with e-commerce platforms and the use of generative AI in internal processes all multiply the potential entry points.

Cybercriminal groups are also becoming more organized and more efficient. As Wired Security points out, the professionalization of cybercrime has lowered the technical bar for launching large-scale attacks. As a result, SMEs, historically seen as less attractive targets, are now in the crosshairs.

That's why investing in security skills and processes is no longer an option reserved for large companies. It's a competitive necessity for any business that wants to operate reliably in the digital market.

How SHM Studio helps SMEs manage digital risk

At SHM Studio, we help Italian SMEs build solid, secure digital infrastructure. Our approach builds security into every phase of the digital project: from web design to SEO strategies, from LinkedIn campaigns to the production of editorial content.

We don’t offer hands-on cybersecurity services in the strict sense. But we can help companies assess their technology risk and find the specialist partners that best fit their needs. Our role is that of full-scope digital consultants, able to read the security implications of everyday technology choices.

SMEs interested in assessing their digital maturity can contact us for an initial conversation. Our blog is also a good place to start keeping up with industry trends.