If you suspect your SonicWALL VPN configuration was stolen, the first thing to check is whether your device used SonicWALL’s optional cloud backup feature. SonicWALL confirmed that attackers accessed backups stored in this service, which included firewall configuration data, VPN credentials, and pre-shared keys (PSKs). If your organization had this feature enabled, you should assume that your VPN configuration may have been exposed.
Administrators should immediately rotate all PSKs, reset user and admin passwords, and verify that no old credentials are still active. It’s also important to review access logs for unusual VPN connection attempts and ensure that all devices are running the latest SonicWALL firmware updates. Even if you did not use the cloud backup feature, perform a quick audit of your network to confirm that all VPN connections are using unique and secure credentials.
For step-by-step instructions on how to secure your VPN after the SonicWALL leak, refer to the VPN Tracker guide.
