Cisco’s Duo Security Incident: Threat Actor Accesses MFA SMS Logs Through Supplier Phishing Attack

Cisco is informing customers about a security incident involving one of their Duo telephony suppliers. A threat actor gained access to the supplier’s internal systems using a phishing attack and downloaded MFA SMS message logs. The logs contained phone numbers, carriers, countries, and states, but not message content. The supplier has taken immediate action, including invalidating the employee’s credentials, implementing mitigation measures, and providing awareness training. Customers are advised to notify affected users, be vigilant against social engineering attacks, and report any suspicious activity.

Duo isn’t alone — The US cybersecurity agency, CISA, is advising Sisense customers to reset their credentials and secrets following a security incident. The exact nature of the incident is unclear, but CISA is actively collaborating with industry partners to respond. Sisense, a data analytics company, serves big companies globally and relies on credentials to access customer data for analysis. The company has not commented on the incident.   Angry customers are demanding more detailed answers and clarification on the impact. The breach allegedly started with hackers breaching Sisense’s GitLab code repository and exfiltrating several terabytes of customer data.

The FBI has issued a warning about a massive wave of SMS phishing attacks targeting Americans with fake road toll fee notifications. The scammers impersonate toll collection services and send text messages claiming that the recipient owes money for unpaid tolls. The FBI has received over 2,000 complaints regarding these attacks, and the scam appears to be moving from state to state. Recipients are advised not to click on any links, delete the messages, and report them to the FBI’s Internet Crime Complaint Center (IC3).

Duo is a popular choice among IT Service providers, so if you were not aware, now you are.   Contrast that with Sisense’s response. Silence does the company no favors.    It bears repeating – over communicate in a crisis.    It’s a core tenant for a reason.

The lack of clarity and delayed response from Sisense as reported, coupled with the substantial customer data allegedly involved, could erode trust and affect customer relations significantly. Organizations must have rapid response strategies in place not only to mitigate the damage but also to communicate effectively with stakeholders to maintain confidence.