Cisco builds a large share of the world’s network security equipment, and Webex is one of the most widely used meeting and calling platforms in government. That makes the company’s own security incidents unusually instructive, because if it can happen to Cisco, the same weaknesses almost certainly exist in smaller organisations.
This article covers three separate events. In 2022 attackers got into Cisco’s corporate network by phoning an employee. In March 2024 a German Air Force Webex call was recorded and published by Russian state media. And in May 2024 researchers showed that details of thousands of government Webex meetings could be looked up from the open internet.
They have different causes, but they share a theme that matters to every business choosing a phone and meeting platform: the technology usually held up, and the gaps were in how people and settings were managed around it.
The short version
2022: a Cisco employee’s VPN password was stolen from their personal Google account, and attackers used voice phishing and MFA fatigue to get past the second factor. No ransomware was deployed and Cisco reported no impact on products or customer data. March 2024: a Luftwaffe Webex call leaked because one participant joined over an insecure line from a hotel. May 2024: predictable meeting numbers let outsiders see metadata for government Webex meetings until Cisco fixed it on 28 May.
1. Cisco, 2022: One Phone Call Into the Corporate Network
Cisco detected the intrusion on 24 May 2022 and published a detailed account through its Talos threat intelligence team on 10 August, the same day the attackers posted a list of files they claimed to have stolen. It is one of the most candid breach write-ups a large vendor has published.
How they got in
- A synced password. The employee had saved their Cisco credentials in their web browser, which synced them to a personal Google account. The attackers compromised that personal account and found the corporate VPN password inside.
- Voice phishing. A password alone wasn’t enough, because Cisco used multi-factor authentication. So the attackers rang the employee repeatedly, posing as trusted support organisations, speaking English with a range of accents, to persuade them to approve a login.
- MFA fatigue. Alongside the calls, the attackers triggered push notification after push notification to the employee’s phone. Eventually one was accepted.
- Persistence. Once on the VPN, the attackers enrolled new MFA devices of their own, so they no longer needed the employee’s approval.
What they did next
Talos traced the attackers escalating to administrator privileges, moving into Citrix servers and domain controllers, and dumping credential databases. They deployed standard intrusion tooling, including Cobalt Strike, Mimikatz and remote-access software such as TeamViewer and LogMeIn, and created a hidden local admin account.
Cisco detected and evicted them before ransomware could be deployed. The confirmed exfiltration was the contents of a Box folder linked to the compromised employee and employee authentication data from Active Directory. The attackers then emailed Cisco executives with screenshots of the stolen folder and threats. In September 2022 they published the files, and Cisco confirmed the content matched what it had already identified.
Cisco said it found no impact on its business, its products and services, customer data, sensitive employee information, intellectual property or supply chain. It forced a company-wide password reset.
Who was behind it
Talos assessed with moderate to high confidence that the intrusion was carried out by an initial access broker with links to the UNC2447 cybercrime group, the Lapsus$ group and the Yanluowang ransomware operators. The Yanluowang gang publicly claimed the attack and said it had stolen 2.8GB of data.
2. March 2024: The Taurus Leak and the Insecure Dial-In
On 1 March 2024 the head of Russia’s RT network published a 38-minute recording of senior German Air Force officers discussing how Taurus cruise missiles might be supplied to Ukraine. German officials quickly confirmed it was genuine.
The call had been held on Webex, running on the German armed forces’ own servers. According to Defence Minister Boris Pistorius, the leak came down to an “individual error”: one participant joined from a hotel in Singapore, where he was attending an air show, over a line that wasn’t secure, and not every participant followed the required secure dial-in procedure.
This wasn’t a flaw in Webex. It was a reminder that a meeting is only as secure as its weakest connection. Once one participant joins by phone over an ordinary network, or from an untrusted Wi-Fi connection, the encryption protecting everyone else no longer covers the whole conversation.
3. May 2024: Predictable Meeting Numbers
Two months later, on 4 May 2024, German publication Zeit Online reported that it could see details of Bundeswehr Webex meetings, including dates, participants and topics, going back months. The weakness had been found by researchers from the Netzbegrünung association and verified by Zeit Online’s reporters.
The cause was surprisingly simple. Meeting numbers were not assigned randomly, and a misconfigured mobile view of the service returned meeting information to anyone who asked for a valid number. Stepping through numbers in sequence exposed meeting metadata, and in some cases links to join. As the reporting widened, the same exposure turned up for meetings involving the German Chancellery, the Bundestag, several federal ministries, the Federal Office for Information Security (BSI) and government bodies in other European countries.
Cisco’s statement confirmed the problem: “In early May 2024, Cisco identified bugs in Cisco Webex Meetings that we now believe were leveraged in targeted security research activity allowing unauthorized access to meeting information and metadata in Cisco Webex deployments for certain customers hosted in our Frankfurt data center.” Cisco said the fixes were fully in place worldwide by 28 May 2024. The German government temporarily took its Webex instance offline, and the BSI advised organisations to delete and reschedule any meetings created before the fix.
| Cisco 2022 | Taurus leak, March 2024 | Webex metadata, May 2024 | |
|---|---|---|---|
| Root cause | Stolen password plus vishing and MFA fatigue | Participant joined over an insecure line | Predictable meeting numbers and a misconfigured view |
| Product flaw? | No | No | Yes |
| What was exposed | Box folder contents, AD authentication data | Full audio of one meeting | Meeting dates, titles, participants, some links |
| Customer action needed | No | Enforce secure joining procedures | Reschedule meetings created before 28 May 2024 |
4. Five Lessons for Businesses Using Cloud Calling and Meetings
- Push approvals can be worn down. MFA fatigue works because tapping “approve” is easy. Turn on number matching (where the user types a code shown on the login screen) at a minimum, and move admins to FIDO2 keys or passkeys, which can’t be approved by mistake.
- Keep work passwords out of personal accounts. The Cisco breach began outside Cisco. Use a business password manager and block browser password sync to personal profiles on company devices.
- Treat meeting links as secrets. Anyone with the link, or a guessable meeting number, can often see a meeting’s title and time or even join. Use lobbies or waiting rooms, require passcodes, and avoid putting sensitive detail in meeting titles.
- Dial-in is the weak link. A participant joining by phone over the public network isn’t protected by the app’s encryption. For sensitive discussions use end-to-end encrypted meetings, which usually means disabling dial-in, and make every participant join through the app.
- Nobody from IT will ring you asking you to approve a login. Make that rule explicit for staff. It would have stopped the Cisco attack, and it would stop the social engineering behind the 2026 RingCentral breach and the 2022 Twilio breach.
5. A Meeting Security Checklist for Australian Businesses
Whichever platform you use (Webex, Microsoft Teams, Zoom or the meeting feature built into your cloud phone system), these settings cover most of the risk:
Turn on
- Lobby or waiting room for external guests
- Meeting passcodes
- Randomly generated meeting IDs
- End-to-end encryption for sensitive meetings
- SSO and MFA for all staff accounts
Avoid
- Reusing a personal room for confidential calls
- Sensitive detail in meeting titles
- Phone dial-in for sensitive discussions
- Recording by default
- Joining from public or hotel Wi-Fi without a VPN
If your meetings are recorded, those recordings are likely personal information under the Privacy Act, and recording without consent can breach state surveillance laws. Our security and compliance guide sets out the rules by state. If you are weighing Webex or Teams against a dedicated cloud phone system, our Teams Phone vs cloud PBX comparison covers the wider trade-offs, and our guide to phone systems for remote and hybrid teams covers device security for staff working away from the office.
6. The Bottom Line
Of the three incidents, only one was a genuine product flaw, and Cisco fixed it within weeks. The other two were people and process: a password in the wrong place, a tired employee tapping approve, an officer on an insecure line in a hotel room.
That is the pattern across the industry. Modern cloud calling and meeting platforms are, on the whole, well engineered. The breaches happen at the edges, where people log in, join and approve things. Configure those edges deliberately and you remove most of the risk that caught out one of the biggest security companies in the world.
Sources
- Cisco Talos: Cisco Talos shares insights related to recent cyber attack on Cisco
- BleepingComputer: Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen
- Kyiv Independent: German defence minister on the Taurus conversation leak
- Help Net Security: Vulnerability in Cisco Webex cloud service exposed government authorities, companies
- SecurityWeek: Cisco patches Webex bugs following exposure of German government meetings
- heise online: Bundeswehr Webex conferences were accessible for months
Frequently Asked Questions
How was Cisco hacked in 2022?
An employee had synced their Cisco VPN password to a personal Google account through their browser. Attackers compromised that account, then used repeated voice phishing calls and a flood of MFA push notifications until the employee approved a login. Cisco detected the intrusion on 24 May 2022, removed the attackers before ransomware was deployed, and published details on 10 August 2022.
Was customer data stolen in the Cisco breach?
Cisco said it found no impact on customer data, its products and services, intellectual property or supply chain. The confirmed stolen data was the contents of one employee’s Box folder and employee authentication data from Active Directory.
What is an MFA fatigue attack?
MFA fatigue, or push bombing, is when an attacker who already has a password triggers login approval requests over and over, often while phoning the victim and posing as IT support, until the victim approves one to make it stop. Number matching reduces the risk, and FIDO2 security keys or passkeys remove it.
Was Webex hacked in 2024?
In May 2024 researchers showed that metadata for Webex meetings hosted in Cisco’s Frankfurt data centre, including many German government meetings, could be retrieved because meeting numbers were predictable and a mobile view was misconfigured. Cisco fixed the bugs by 28 May 2024. Separately, the March 2024 Taurus leak of a German Air Force Webex call was caused by a participant joining over an insecure line, not by a Webex flaw.
Is Webex safe to use for business?
Yes, for most businesses, provided it is configured sensibly: lobbies for external guests, passcodes, random meeting IDs, SSO with strong MFA, and end-to-end encryption with dial-in disabled for sensitive discussions. The same settings apply to Teams, Zoom and the meeting features in cloud phone systems.
Are phone dial-in participants in a video meeting encrypted?
Not end to end. A participant who joins by dialling in over the public telephone network is carried over ordinary phone lines, which are outside the meeting app’s encryption. For confidential meetings, require everyone to join through the app and disable dial-in.