Optimizely Confirms Data Breach After Vishing Attack
Summary
Optimizely says vishing attackers accessed internal systems and stole basic business contact information from CRM records and limited back-office documents. The company reports no evidence of access to sensitive customer data and warns of follow-up phishing; ShinyHunTER
Key points
- Optimizely says attackers gained access to internal systems through a voice-phishing (vishing) attack.
- The company says attackers stole basic business contact information from certain CRM records and a limited set of internal back-office documents; the number of affected customers was not disclosed.
- Optimizely reports no evidence that attackers accessed sensitive customer data or personal information beyond basic business contact details.
- The company says attackers could not escalate privileges, install software, or create backdoors, and that business operations continued without disruption.
- Optimizely warned customers to watch for follow-up calls, texts, or emails attempting to obtain passwords, MFA codes, or other credentials.
- The article says a connection to the ShinyHunters extortion operation is suspected, but Optimizely has not named the attackers.
- The article describes related SSO vishing tactics and device-code vishing using the OAuth 2.0 device authorization grant flow; it does not establish that these techniques were used in the Optimizely incident.
Article Details
- Victim Organization
- Optimizely
- Incident Type
- Unauthorized access and theft of basic business contact information following a voice-phishing (vishing) attack
- Data Types Exposed
- Basic business contact information
- Affected Records
- Undisclosed number of customers; the number of exposed records was not disclosed.
- Operational Impact
- Access was confined to certain internal business systems, CRM records, and a limited set of back-office documents. Optimizely said business operations continued without disruption and reported no evidence of access to sensitive customer data beyond basic business contact information.
- Ransom Or Extortion
- No ransom demand or extortion payment was reported. The article says the incident is suspected to be linked to the ShinyHunters extortion operation; threat actors reportedly contacted the company on February 11 claiming access to its systems.
- Claim Status
- confirmed