--- title: Cisco breached in Yanluowang ransomware attack, 2.8 GB data stolen description: "Multi-national tech conglomerate Cisco has confirmed that the Yanluowang ransomware gang breached its corporate network in late May, and that the group tried to extort them by threatening to leak stolen files online. The Yanluowang gang claims to have stolen 2.8 GB of data, consisting of approximately 3,100 files which Cisco has described as \"not sensitive.\"" canonical_url: https://www.acronis.com/en/tru/posts/cisco-breached-in-yanluowang-ransomware-attack-28-gb-data-stolen/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 15 August 2022 # Cisco breached in Yanluowang ransomware attack, 2.8 GB data stolen Multi-national tech conglomerate Cisco has confirmed that the Yanluowang ransomware gang breached its corporate network in late May, and that the group tried to extort them by threatening to leak stolen files online. The Yanluowang gang claims to have stolen 2.8 GB of data, consisting of approximately 3,100 files which Cisco has described as "not sensitive." Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=DxlYwR-ORZE) Multi-national tech conglomerate Cisco has confirmed that the Yanluowang ransomware gang breached its corporate network in late May, and that the group tried to extort them by threatening to leak stolen files online. The Yanluowang gang claims to have stolen 2.8 GB of data, consisting of approximately 3,100 files which Cisco has described as "not sensitive." An investigation conducted by Cisco Security Incident Response (CSIRT) and Cisco Talos revealed that the threat actors compromised a Cisco employee’s credentials after gaining control of a personal Google account, where credentials saved in the victim’s browser were being synchronized. After obtaining the credentials, the attackers launched voice-based phishing attacks in an attempt to trick the victim into accepting the multi-factor authentication (MFA) push notification started by the attacker. The attacker convinced the Cisco employee to accept MFA push notifications through MFA fatigue. Cisco says that the Yanluowang gang did not deploy any ransomware on its network during the attack. The [Advanced Email Security pack](https://www.acronis.com/en-us/products/cloud/cyber-protect/email-security/) for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) prevents malicious emails from reaching users' inboxes, while the included multi-layered detection identifies and blocks malware threats from executing before they can impact your systems or data. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)