Cisco.com user profile data exported after a vishing call
Cisco said that on July 24, 2025 a bad actor targeted a Cisco representative with a voice phishing call and gained access to a third-party, cloud-based CRM instance, exporting a subset of basic profile data for Cisco.com users: names, organization names, addresses, Cisco-assigned user IDs, email addresses, phone numbers and account metadata. Cisco said its products and services were not affected.
- Victim
- Cisco
- Industry
- Technology
- Country
- United States
- Intrusion began
- Jul 24, 2025
- First disclosed
- Aug 1, 2025
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
One phone call reached a CRM holding registered-user profiles. Phishing-resistant MFA for CRM access and blocking unapproved API clients would have stopped the export.
Sources
- Cisco Event Response: Vishing Attack Impacting Third-Party CRM System, Cisco, Aug 1, 2025
- Cisco disclosed a CRM data breach via vishing attack, Security Affairs, Aug 5, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). Cisco.com user profile data exported after a vishing call. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-cisco-crm-vishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.