When we tried to connect to Sophos Central this morning to one of our clients using admin account we realized that password were changed. We had access to this account until yesterday evening. We started to check other clients and we found that passwords changed also.
We contact everyone especially for central admin email accounts that we don't monitoring and no one reset passwords. No notification emails received about password reset.
Every affected account managing XG firewalls that reported NOT breached by the recent attack.
How can we see who changed the passwords and when? Are there any logs for admin access in Central? Why did not receive any notification for password change?
This thread was automatically locked due to age.
