FortiGate config leaks: Victims' email addresses published

Thousands of email addresses included in the Belsen Group's dump of FortiGate configs last week are now available online, revealing which organizations may have been impacted by the 2022 zero-day exploits. Infosec expert Kevin Beaumont uploaded the IP and email addresses associated with the leaked FortiGate configs to GitHub, while fellow researcher Florian Roth separately extracted them and grouped them via top-level domains (TLDs). Beaumont said the aim here was to provide defenders with the information they need to identify which organizations may have been impacted and require further investigation. However, not everyone will include their email addresses in config files, so the resource won't help every victim. According to Roth's grouped data, a smidge under 5,000 organizations' domains were included, and may benefit from, Beaumont's publication. However, onlookers in the security community, such as one Group-IB threat intelligence analyst, said the list isn't exhaustive and doesn't capture all the emails included in the leak. The victim list that was published is truly global, however. A few simple CTRL+Fs reveal a selection of major, high-profile organizations are included, as well as a bevy of domains tied to governments around the world. The Register contacted some of the more notable inclusions in the data for a response. A reminder for those who missed last week's leak: A new band of baddies going by the name of The Belsen Group leaked around 15,000 FortiGate conf...