A threat group claims that they are selling “FortiBleed Dataset 2026” which is described as a private collection of 68,520 exposed credential records across 21,387 domains, allegedly linked to FortiGate SSL-VPN and HTTP admin access. It includes masked login URLs, FortiGuardIDs, and access countries, with India, the US, and the UAE among the most represented. They gained 1,931 records from UAE.