Breachesby GlyphCisco
Disclosed Aug 10, 2022Confirmed
Yanluowang-linked attacker breaches Cisco via employee's synced Google account
Cisco Talos said an attacker got an employee's saved credentials through a compromised personal Google account and used voice phishing and MFA push fatigue to access the VPN. The only confirmed exfiltration was a Box folder and employee authentication data from Active Directory.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Aug 10, 2022 |
| Attack | Phishing |
| Data exposed | Internal documentsCredentials and tokens |
| Sector | Tech · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at Cisco
Cisco source code reportedly stolen using Trivy supply-chain credentialsSupply chain exposed source code and API keys.Supply chainTechUSUnverifiedMar 31Vishing attack on Cisco CRM exposes Cisco.com user profilesPhishing exposed names, addresses, emails and phone numbers.PhishingTechUSUnverifiedAug 4, 2025
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.