Cisco sent out a notice this week that the Cisco Duo multifactor authentication (MFA) service had been compromised by a sophisticated social engineering attack on one of its telephony providers. The breach potentially exposed some message logs containing data like phone numbers and carrier information for accounts that used SMS or voice-based MFA through Cisco Duo over the past month.

“Cisco is aware of an incident involving a single telephony supplier that sends Duo MFA messages via SMS and VOIP to recipients based in North America. Cisco is actively working with the supplier to investigate and address the incident,” a Cisco spokesperson told SDxCentral in an email. “Based on information received from the supplier to date, we assessed that approximately 1% of Duo’s customers were impacted. Our investigation is ongoing, and we are notifying affected customers via our established channels as appropriate.”

In 2018, Cisco acquired two-factor authentication (2FA) startup Duo Security for $2.35 billion. The tech giant integrated its technology and expanded it to be a security platform that provides MFA and single sign-on (SSO) to protect access to applications and data for any user, device, and location. Cisco claims that based on the zero trust security from Duo, it now secures more than 100,000 users and over 170,000 devices in 98 countries worldwide.

In a letter sent to affected customers, the Cisco Data Privacy and Incident Response Team revealed that Cisco uses the impacted telephony supplier to send MFA messages via SMS and voice over IP (voice over internet protocol (VOIP)) to its customers. On April 1, 2024, an unidentified threat actor was able to illicitly obtain the supplier employee’s credentials through a phishing attack and gain access to the telephony provider’s internal systems.

The attacker then used those stolen credentials to gain access to the vendor's internal systems and download a cache of SMS message logs related to Duo customer accounts from March 1st to March 31st, 2024.

While the message content itself was not accessed, the logs contained sensitive data such as the phone number, phone carrier, country and state to which each message was sent, as well as other metadata including the date and time of the message and type of message, according to Cisco.

Upon discovering the breach, the supplier claims it immediately conducted an investigation and implemented mitigation measures, including immediately invalidating the employee’s credentials, analyzing activity logs and notifying Cisco of the incident. The vendor provided Cisco with a copy of the Duo message logs that the threat actor obtained.

Because the threat actor obtained access to the message logs through a successful social engineering attack on the telephony supplier, Cisco urges affected customers to contact their users whose phone numbers were contained in the message logs immediately, notify them of the incident, and advise them to be vigilant and report any suspected social engineering attacks to the relevant incident response team or other designated point of contact.

SMS 2FA is less secure than passkeys

The breach is a sobering reminder that even widely adopted MFA solutions from major security players like Cisco can be compromised through social engineering tactics targeting employees at third-party vendors.

“Cisco Duo's telecom provider got compromised because someone there got phished,” Descope co-founder Rishi Bhargava said in a statement. “Nine out of 10 times, attackers phish for credentials — but only if the credentials can be phished.”

While MFA reduces risk significantly compared to password-only authentication, traditional 2FA or MFA channels like SMS and voice are still vulnerable to these types of supply chain attacks.

“This is further proof for app developers to move to more 'unphishable' MFA methods like passkeys. SMS-based 2FA can be prone to social engineering, but with passkeys, there's nothing for the user to 'know' and thus nothing they can give away to the attacker,” Bhargava said.

“Moreover, the data leaked in this breach may give attackers enough ammo to attempt SIM swapping attacks - another reason SMS 2FA is considered among the less secure forms of 2FA,” he added.

Update: This story has been updated to include Cisco's comment.