how it happened
- whoattackerpersonal Google account
- the gapwork credentialssynced to a personal account
- the resultcorporate networkVPN access gained
what everyone assumed
Browser password sync feels like a personal convenience with personal scope, your logins following you across your devices. The assumption is that what the browser saves stays within your own orbit, not bridging personal and corporate worlds.
what happened
The attacker compromised the employee’s personal account, harvested the synced corporate credentials, and then used voice phishing and MFA fatigue to get a VPN prompt approved. The personal sync had quietly delivered the work passwords; the rest was persuasion.
step by step
- an employee syncs work passwords into a personal Google accountThe browser stores corporate credentials there.the assumption breaks here
- the personal account is compromisedThe attacker harvests the synced credentials.
- voice phishing and MFA fatigueRepeated prompts and calls get a VPN push approved.
- 2022the attacker is on the corporate networkCisco confirms the intrusion.
how it surfaced
In 2022 Cisco confirmed that an attacker reached its corporate network after compromising an employee’s personal Google account containing browser-synced credentials, then defeating MFA through fatigue and vishing.
Browser sync carries credentials wherever the personal account goes, including into an attacker’s hands if that account is breached.
Work secrets saved in a personal browser are work secrets stored outside your control.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersIt gets hacked, and the attacker finds the saved work logins inside.what it costs youThey then bombard the employee with login prompts until one gets approved, and they are in.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
sources
your turn
what you can do about it
this week
Check whether work browsers can sync saved passwords into personal accounts.
Your employees' browsers offer to sync saved passwords to personal accounts, and some have accepted, carrying corporate logins into places you do not manage. Cisco is what that bridge can cost. Whether browser sign-in and credential storage are governed on work machines is the lever this incident points to.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →