What happened

Cisco disclosed in early August 2025 that it had suffered a data breach affecting user accounts associated with Cisco.com, its main customer- and partner-facing web portal. According to the company's security advisory, Cisco became aware of the incident on July 24, 2025, when an employee was successfully targeted by a voice phishing, or "vishing," attack. The attacker used the access gained through that call to reach a third-party, cloud-based CRM system that Cisco uses to manage customer profile data, and exported a subset of records from it.

Cisco has not publicly confirmed which CRM vendor or the identity of the attackers, but the incident bears the hallmarks of the broader vishing campaign that cybersecurity researchers link to the ShinyHunters extortion group, also connected to the loosely affiliated Scattered Spider collective. That campaign relied on convincing phone-based impersonation of IT or help-desk staff to trick employees at dozens of large companies into granting CRM access, rather than exploiting a software vulnerability.

What data was exposed

Cisco said the information accessed and exported included basic profile data tied to registered Cisco.com users: names, organization names, Cisco-assigned user IDs, email addresses, phone numbers, and account metadata such as account creation dates. Cisco was explicit that no passwords, financial information, or other sensitive personal or confidential enterprise data were compromised, and that the breach did not affect Cisco's products, services, or any Cisco network infrastructure.

Reporting on the wider campaign has cited claims from ShinyHunters, which posted extortion demands referencing more than three million Salesforce-linked records allegedly taken from Cisco as part of this campaign, though Cisco's own public statements described the confirmed compromise in narrower terms limited to the CRM profile data noted above. Separately, in early 2026 the same extortion group resurfaced with broader claims against Cisco involving GitHub repositories and cloud storage buckets, though those later claims represent a distinct extortion episode rather than an expansion of the confirmed 2025 vishing incident.

The broader campaign

Cisco's breach fits into the same 2025 wave of Salesforce-linked social engineering attacks that also hit Google, Workday, Adidas, Qantas, Allianz Life, Chanel, Louis Vuitton, Dior, and Tiffany & Co. In nearly every case, the attackers' method was consistent: rather than trying to break through technical defenses, they called employees, impersonated internal IT or HR staff, and manipulated them into either reading back multi-factor authentication codes or approving a rogue connected application inside the company's Salesforce or CRM environment. Once approved, that access allowed attackers to query and export CRM records at scale without needing to compromise a single password.

Response and remediation

Cisco said it moved immediately to terminate the attacker's access once the vishing-driven intrusion was identified, and it launched an investigation into the scope of the incident. The company published a dedicated security advisory describing the incident and notified affected customers where legally required to do so.

For remediation, Cisco said it was reinforcing employee security awareness training specifically focused on recognizing and resisting vishing attempts, and refining its internal telephonic identity-verification protocols to require stronger second-factor validation and call-back procedures before granting any account or system access requested over the phone. Cisco also urged customers whose contact information may have been exposed to be alert for follow-up phishing or vishing attempts that might reference their real Cisco account details to appear more credible, a tactic security researchers noted was common in the aftermath of similar breaches across the same campaign.

Why it matters

The Cisco incident, alongside the parallel breaches at Google, Workday, and other major technology and retail brands, illustrated how a single well-executed social engineering technique — a phone call — could bypass otherwise sophisticated technical security controls at some of the world's largest and most security-mature companies. Security teams increasingly pointed to the campaign as evidence that help-desk and identity-verification processes, not just software patching, need to be treated as a primary attack surface.

Advisory details and customer guidance

Cisco published a dedicated advisory on the incident through its security center, walking through the timeline and the specific data categories involved so that Cisco.com account holders could assess their own exposure. The company reiterated that the breach had no impact on Cisco's products, services, or the networks Cisco customers themselves operate, distinguishing the incident from a product-security vulnerability and framing it squarely as a CRM data-handling issue tied to third-party platform access.

Cisco advised affected users to be alert for phishing or vishing attempts that might reference the exposed account details — name, organization, Cisco-assigned user ID, or account creation date — to appear more convincing. Because Cisco-assigned user IDs are not typically public information, security researchers warned that any follow-up message referencing one should be treated as a red flag rather than as proof of legitimacy, since it likely originated from the stolen dataset rather than from an authentic Cisco source.

Part of a pattern across the tech sector

Cisco's disclosure landed within days of Google's own admission that a nearly identical vishing technique had been used against one of its Salesforce instances, and only weeks before Workday's separate but related disclosures. Taken together, the string of incidents at major technology vendors throughout mid-2025 demonstrated that the ShinyHunters-linked campaign was not opportunistic but methodically worked through a target list of large organizations running Salesforce-based CRM systems, applying the same core vishing playbook with only minor variations from company to company.