Provenance Record

Well-structured News piece (683 words). Overview / What We Know / Scale / What We Don't Know / Analysis sections. Technical depth is accurate (config-file harvesting, offline SHA-256 cracking, PBKDF2 migration in FortiOS 7.2.11/7.4.8/7.6.1, 45-GPU Hashtopolis cluster). The 'What We Don't Know' section honestly explains why vendor figures diverge by counting methodology.

Read all five available gzipped snapshots from disk; the sixth (Cyber Security News) returned HTTP 403 and could not be snapshotted. source-0 (Arctic Wolf): confirms SOCRadar 30,000-75,000 working creds across 194 countries, PBKDF2 introduction in FortiOS 7.2.11/7.4.8/7.6.1, legacy SHA-256 storage, 'log in after upgrading' and MFA recommendations. source-1 (SecurityWeek): confirms the Diachenko quote VERBATIM ('They intercept SSL VPN authentication, crack hashes on a 45-GPU cluster managed via Hashtopolis, and pivot into internal Active Directory environments'), Beaumont + Hudson Rock independent verification, CISA alert issued Thursday (June 18) with the exact hardening actions listed, and 'over 86,000' / 86,644 figures. source-2 (CSO Online): confirms ~75,000 firewalls, ~50% of Shodan-visible Fortinet firewalls, 194 countries, 21,000+ domains, India/US/Mexico top countries, the 'systematically collected configuration files... recover working administrator credentials' quote verbatim, and the SHA-256-until-login storage detail. source-3 (Recorded Future): confirms 73,932 FortiGate firewall URLs across 194 countries, ~1.16 billion credential attempts against 320,777 targets, 45-GPU Hashtopolis cluster, Insikt Group, Russian-speaking attribution, Diachenko June 13 discovery, and the rotate-credentials/MFA recommendations. source-5 (Shattered Security): confirms 86,644 unique compromised devices by June 19, 194 countries, 'one of the most globally distributed credential-exposure events', Diachenko June 13 discovery, and the FG-IR-26-060 / FG-IR-25-647 recycled-credential codes. source-4 (Cyber Security News) HTTP 403 — UNVERIFIABLE via snapshot; the three facts it is cited for (CISA advisory, FG-IR codes, 'up to 86,000') are each independently confirmed in verified snapshots (SecurityWeek and Shattered), so no claim depends on it.

Every number, name, code, quote, and date traces to a cited source and matches the snapshot. No hallucinations detected. CISA's primary alert and The Hacker News are NOT cited inline; no headline/summary/lead claim rests on a bot-blocked source.

High-quality, accurate, well-attributed submission. The automated script suggested APPROVE_WITH_CORRECTIONS, but its two warnings are infrastructure flags (allowlist gap + one bot-blocked snapshot), not content defects: every claim the 403 source is cited for is independently corroborated in a snapshot I read, and the conflicting vendor figures are each correctly attributed inline. No correction is honestly needed. Verdict: APPROVE.