Cisco Source Code and Data Leak Allegedly Claimed by ShinyHunters

The notorious hacking group ShinyHunters has claimed responsibility for a major breach of Cisco’s internal development networks, allegedly stealing sensitive source code, AWS credentials, and private GitHub repositories with potential exposure extending to Salesforce, Aura, and several U.S. government agencies.

The Attack Vector: A Supply Chain Compromise

The intrusion originated from a supply chain attack targeting Trivy, a widely used open-source vulnerability scanner.

Threat actors deployed a malicious GitHub Action plugin linked to the Trivy compromise to silently harvest developer credentials.

Using these stolen credentials, attackers bypassed Cisco’s authentication controls and gained unauthorized access to its internal build environments.

Once inside, attackers compromised dozens of devices, including lab workstations and developer computers, giving them a direct foothold into Cisco’s most sensitive corporate systems.

See more

BREAKING

New Cisco Update

Cisco source code and data was stolen by ShinyHunters claiming 3 breaches

Salesforce, Aura and AWS buckets pic.twitter.com/NsnBzmdTVN

— Dominic Alvieri (@AlvieriD) April 1, 2026

What Was Stolen

The scope of stolen data is significant:

• Multiple AWS access keys are used to perform unauthorized operations inside Cisco’s cloud accounts
• Over 300 cloned private GitHub repositories, containing source code for unreleased tools and products, including Cisco’s AI Assistant and AI Defense technologies
• Repositories allegedly belonging to major banks, BPO firms, and U.S. government agency clients, amplifying the downstream risk considerably

Cisco’s internal security units, its Unified Intelligence Center, CSIRT, and EOC, responded rapidly. The company isolated compromised systems, began wiping and reinstalling affected machines, and enforced a mass employee credential reset to lock out the attackers.

Despite these swift containment steps, Cisco has not yet released a public statement on the breach. Internal sources indicate the company anticipates continued complications from the incident.

While ShinyHunters is publicly claiming credit for the data theft, security researchers have attributed the underlying Trivy supply chain attack to a separate group: TeamPCP.

This group wields a custom malware strain called “TeamPCP Cloud Stealer”, engineered to hijack developer ecosystems including Docker, NPM, and PyPI.

TeamPCP is also connected to recent supply chain breaches targeting the LiteLLM and Checkmarx projects, raising concerns that Cisco may face secondary attacks stemming from these related vulnerabilities.

The incident underscores the growing risk of supply chain attacks against developer tooling.

A single compromised plugin can cascade into enterprise-wide data exposure, affecting not just the targeted company but its clients and cloud infrastructure as well.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google