https://reddit.com/r/cybersecurity/comments/1wcqh4p/a_uk_council_breach_reported_in_july_turned_out/: 🕵️‍♂️ 🏴󠁧󠁢󠁥󠁮󠁧󠁿 A UK council breach reported in July turned out to be one of many, tied to mass SonicWall exploitation

Published Sep 10, 2026

Updated

Affected Software

1 affected component

SonicWall SMA1000=

Frequently Asked Questions

Which organizations should treat this as a priority investigation?

Organizations operating SonicWall SMA1000 appliances should prioritize review, especially because the reported activity began two days after disclosure of the cited flaw and targeted roughly 250 organizations. Confirmed victims were reported in France, India, Italy, the UK, and the US.

What was the reported impact after compromise?

The reported operation stole credentials from the SonicWall appliances themselves. Credentials from at least nine Active Directory domains were reported as compromised.

Is this limited to the publicly named UK council incident?

No. The research linked the council incident, at moderate confidence, to a broader operation affecting dozens of organizations, with many alleged victims not publicly reported.

https://reddit.com/r/cybersecurity/comments/1wcqh4p/a_uk_council_breach_reported_in_july_turned_out/: 🕵️‍♂️ 🏴󠁧󠁢󠁥󠁮󠁧󠁿 A UK council breach reported in July turned out to be one of many, tied to mass SonicWall exploitation

Affected Software

Frequently Asked Questions

Which organizations should treat this as a priority investigation?

What was the reported impact after compromise?

Is this limited to the publicly named UK council incident?

Company

Resources

Contact

Frequently Asked Questions

Which organizations should treat this as a priority investigation?

What was the reported impact after compromise?

Is this limited to the publicly named UK council incident?