Cisco Duo SMS MFA logs stolen from a phished telephony provider
On April 1, 2024 an attacker used credentials phished from an employee of the telephony provider that delivers Duo's SMS and VoIP MFA messages, and downloaded message logs for certain Duo accounts covering March 1 to March 31, 2024. The logs held phone numbers, carriers, locations and timestamps but not message content. Cisco notified affected customers on April 15 and warned of follow-on phishing.
- Victim
- Cisco Duo (via an unnamed telephony provider)
- Industry
- Technology
- Country
- United States
- Intrusion began
- Apr 1, 2024
- First disclosed
- Apr 15, 2024
- Actor
- Unattributed
- Initial access
- Third-party access
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
SMS MFA depends on telecom suppliers whose own staff logins become part of your identity attack surface; their phishable access exposed MFA metadata for Duo customers.
Sources
- Cisco Duo provider breached, SMS MFA logs compromised, Help Net Security, Apr 16, 2024
- Cisco Duo says hack at telephony supplier exposed MFA SMS logs, SecurityWeek, Apr 15, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Signal account re-registration via Twilio support console 2022 · Third-party access
- Danish CPR register queried through a private company's abused access 2026 · Third-party access
- Commvault Metallic breach exposes Microsoft 365 app secrets 2025 · Third-party access
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
Cite this record
SWI Community Team. (2026). Cisco Duo SMS MFA logs stolen from a phished telephony provider. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-cisco-duo-telephony-provider-phishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.