Overview

• Cisco traced the July 24 breach to a voice-phishing call that tricked an employee into granting access to a third-party cloud CRM.
• The attacker exported basic profile data for Cisco.com users, including names, organization names, addresses, Cisco-assigned IDs, email addresses, phone numbers and account metadata.
• Cisco confirmed that no organizational customers’ confidential information, passwords or other sensitive data were compromised and no other CRM instances were affected.
• The company has terminated the unauthorized access, notified data protection authorities and affected users, and launched a formal investigation.
• Security experts warn the incident is linked to a broader wave of Salesforce-focused extortion campaigns and underscores ongoing risks in third-party cloud platforms following last year’s IntelBroker DevHub leak.