UK council attack was part of the SonicWall SMA1000 exploitation campaign
Assessment
Hunt.io assesses with moderate confidence that the July 17, 2026 cyberattack on the Borough Council of King's Lynn and West Norfolk is linked to the operator conducting mass exploitation of CVE-2026-15409, based on timing (Hunt.io captured the operator's open directory the same day) and the campaign's opportunistic targeting. However, the council's own statement, reported to the NCSC, is that its investigation found no evidence that any data was accessed or stolen, and that the attack did not impede the local election then underway. Hunt.io's confirmed credential-theft victims were in France, India, Italy and the United States; the UK appears only in the wider target inventory, not the confirmed-theft set. A reader repeating 'the council's data was stolen via the SonicWall flaw' would be overstating a moderate-confidence linkage that the victim's own findings partly contradict.
Where this claim appeared
Hunt.io · 2026-09-10
https://hunt.io/blog/sonicwall-sma1000-uk-council-attackWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
SonicWall SMA1000 (CVE-2026-15409): one CVSS-10 SSRF, three threat clusters, Active Directory theft from the applianceThink this assessment is wrong? Report an error.