ShinyHunters posted a “FINAL WARNING” on their dark web leak site targeting Cisco, claiming possession of data stolen across 3 separate intrusions and setting an April 3, 2026 deadline to pay up or face a public data release. The post claims over 3 million Salesforce records containing PII, internal GitHub repositories, and AWS storage contents were taken. What makes this extortion post unusual is what ShinyHunters attached to it: a direct link to Cisco’s own published security advisory on the July 2025 vishing attack, essentially using Cisco’s public admission as their opening argument.
The claim lands on the same day Cisco was separately reported to have lost source code and AWS credentials through the March 2026 Trivy supply chain attack, in which attackers cloned over 300 internal GitHub repositories including source code for unreleased AI products. Whether ShinyHunters obtained their claimed AWS access through that same credential pool or through independent means has not been confirmed.
Starting With What Cisco Already Admitted
The foundation of ShinyHunters’ claim is an incident Cisco disclosed publicly in August 2025. On July 24 of that year, a Cisco employee was targeted in a voice phishing call that tricked them into authorizing a malicious Salesforce connected app via OAuth, handing the attacker authenticated API access without needing a password or clearing MFA. Cisco’s own advisory states the exported data consisted of basic account profile information from Cisco.com registered users including names, email addresses, phone numbers, organization names, and account metadata. The company maintained that no passwords, no customer confidential data, and no other CRM instances were affected.
When new claims emerged in October 2025, Cisco updated that advisory stating it had reassessed and found no evidence the actor obtained anything beyond the original disclosure. ShinyHunters is now directly contradicting that position with a 3 million record figure and screenshots of AWS infrastructure as supporting evidence.
The Salesforce Aura Campaign
The second alleged access point is part of a much broader operation. Since September 2025, ShinyHunters has been working through organizations running misconfigured Salesforce Experience Cloud instances, exploiting guest user profiles with excessive permissions to query CRM data without authenticating. When Mandiant released AuraInspector in January 2026 as a defensive tool to help admins find these misconfigurations, ShinyHunters modified the code and turned it into an automated offensive scanner. The campaign is reported to have hit between 300 and 400 organizations total. Cisco is among those ShinyHunters claims they moved past scanning to actual exfiltration.
AWS Access and the Supply Chain Overlap
The third vector is the least verified but potentially the most serious. ShinyHunters attached screenshots to their post showing what they claim is an AWS EC2 volumes console and S3 bucket listings belonging to Cisco, with drive creation dates of March 16 and 17, 2026. That window sits just days before the Trivy supply chain attack, in which TeamPCP’s credential-stealing malware harvested AWS keys and GitHub tokens from Cisco’s CI/CD pipelines between March 19 and 24. Attackers using those credentials cloned 300+ internal repositories and accessed a subset of Cisco’s cloud accounts before the company isolated the affected systems. The overlap in timing and access patterns is notable, though the two groups operating through the same stolen credential pool, knowingly or not, is also plausible given how CI/CD secrets move through access broker markets.
Who Else May Be Exposed
The scope of the alleged breach extends well beyond Cisco’s own data. According to threat intelligence from Resecurity, the stolen Salesforce dataset reportedly contains records tied to personnel from the FBI, DHS, DISA, IRS, and NASA, as well as the Australian Ministry of Defense and multiple Indian government agencies, likely linked to procurement or configuration of Cisco products and services. The cloned GitHub repositories reportedly include code belonging to banks, business process outsourcers, and US government agency clients.
Exposed Data Types
- Salesforce CRM records containing PII across Cisco’s customer base
- Internal GitHub source code repositories including unreleased AI products
- AWS S3 bucket contents
- AWS EC2 volume data across what screenshots suggest may be 100+ virtual storage drives
- Repositories allegedly belonging to government agencies and corporate customers
Cisco’s Response
Cisco has not issued any public statement addressing the ShinyHunters extortion claim or the Trivy-related source code theft. The April 3 deadline has not yet passed, and no data has been publicly released at the time of writing. Cisco’s only public position on any of this remains the August 2025 advisory that ShinyHunters is now citing against them.
At this time, there is no independent verification of the full breach scope beyond what Cisco previously disclosed. This article will be updated as the situation develops.
