Cisco corporate network breach via synced credentials, vishing and MFA fatigue
Cisco identified an intrusion on May 24, 2022 and disclosed it on August 10, 2022. Cisco Talos reported that the attacker obtained an employee's credentials from a personal Google account that synced browser-saved passwords, then used voice phishing posing as trusted organizations and repeated MFA push requests until the employee accepted, reaching the corporate VPN. Cisco said it found no impact to its business, products or customer data; the attackers later published file names and contents.
- Victim
- Cisco
- Industry
- Technology
- Country
- United States
- Intrusion began
- May 24, 2022
- First disclosed
- Aug 10, 2022
- Actor
- Initial access broker linked to UNC2447, LAPSUS$ and Yanluowang (per Cisco Talos) (Extortion group)
- Initial access
- MFA fatigue
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Corporate credentials should never sync into personal browser profiles, and phishing-resistant MFA would have stopped the vishing and push flood.
Go deeper on SWI
- Technique: MFA fatigue and push bombing
- Technique: OTP relay via social engineering
Sources
- Cisco Talos shares insights related to recent cyber attack on Cisco, Cisco Talos, Aug 10, 2022
- Cisco Event Response: Corporate Network Security Incident, Cisco, Aug 10, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Uber breach via contractor password and MFA fatigue 2022 · MFA fatigue
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
- 0ktapus SMS phishing campaign against Okta users 2022 · Credential phishing
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Cisco corporate network breach via synced credentials, vishing and MFA fatigue. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-cisco-vishing-mfa-fatigue/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.