Dozens of VPN Credentials in a Leak — What to Do in the First 24 Hours
A threat report concluded there was no evidence of valid credentials. One lookup showed dozens of SSL-VPN accounts on an organisation’s own edge firewalls. A leak is not a vulnerability, so a patch does not close it. Here is the order of work for the first 24 hours: kill sessions, rotate everything the firewall trusts, hunt for persistence, close management access, and find the machine that leaked the passwords in the first place.