Vishing Attack Grants Access to CRM System, Exposing User Profiles from Cisco.com
A Voice Call with Costly Consequences
Cisco has confirmed a security breach involving the theft of personal data belonging to Cisco.com users. The incident was caused by a voice phishing attack, also known as vishing, where a cybercriminal tricked a Cisco employee into granting unauthorized access.
- The breach was discovered on July 24, according to a company statement.
- It targeted a cloud-based CRM platform managed by a third-party vendor.
- The attacker successfully exported a subset of Cisco users’ profile information.
What Information Was Stolen?
The compromised data includes basic user profile details stored in Cisco’s CRM system:
- Name
- Organization name
- Address
- Cisco-assigned user ID
- Email address and phone number
- Account metadata, such as account creation dates
While financial or password data was not disclosed as compromised, this information can still be exploited for further social engineering or identity theft attempts.
Cisco Keeps Scope Under Wraps
The company has not disclosed how many users were affected. When contacted by media, Cisco spokesperson Carro Halpin declined to provide a figure.
- The limited disclosure raises concerns about transparency and the potential scale of the breach.
- It’s unclear whether Cisco has notified affected users individually or implemented additional security measures in response.
Part of a Broader Pattern of CRM-Linked Breaches
This breach may be connected to a wider wave of cyberattacks targeting Salesforce data across industries.
- As reported by Bleeping Computer, companies such as Allianz Life, Tiffany & Co., and Qantas have also experienced CRM-related security incidents.
- Cisco is a known customer of Salesforce, though the company did not directly confirm whether the breach was through Salesforce itself.
The Rising Threat of Vishing
Voice phishing remains a potent tactic, especially when targeting employees with CRM or administrative access. These attacks rely on psychological manipulation rather than software vulnerabilities.
- Vishing can be used to bypass multi-factor authentication if the target is coerced into handing over credentials or authorizing access.
- This incident highlights the need for continuous employee training and strict verification protocols for internal access requests.
