Ad tech firm Optimizely confirmed that it suffered a data breach following a sophisticated vishing (voice phishing) attack. 

The company has notified an undisclosed number of customers about the incident, which involved the following details: 

• Attack Method: Threat actors used voice-based social engineering to compromise internal systems. This reportedly involved impersonating IT support to trick employees into providing credentials and Multi-Factor Authentication (MFA) codes.
• Stolen Data: The breach was limited to “basic business contact information“. This data was located within specific internal business systems, records in the company’s CRM, and a limited set of internal back-office documents.
• Mitigation: Optimizely stated that the attackers were unable to escalate privileges, install malicious software, or create backdoors. The company found no evidence that sensitive customer data or personal information beyond basic contact details were accessed.
• Customer Warning: Optimizely has warned its clients to remain vigilant against follow-up phishing attempts—via calls, texts, or emails—that may use the stolen contact information to solicit passwords or further credentials.