Optimizely Confirms Data Breach Following Vishing Attack
Learn More
Optimizely, a New York-based advertising technology firm, confirmed a data breach following a voice phishing (vishing) attack.
The company learned of the incident on February 11, 2026, when threat actors contacted the organization claiming they had gained access to internal systems. Attackers gained access by impersonating IT support staff and calling employees to trick them into providing credentials. The group used phishing sites mimicking legitimate login portals to capture single sign-on (SSO) codes and multi-factor authentication (MFA) tokens of Microsoft Entra authentication.
The compromised data includes:
- Basic business contact information
- Customer Relationship Management (CRM) records
- Internal documents used for back-office operations
The number of affected individuals is not disclosed. The company maintains that no sensitive customer data or personal information beyond business contacts was accessed during the intrusion.
Optimizely has not officially named the attackers but the tactics are consistent with a loosely affiliated group known for aggressive social engineering, a description frequently associated with the ShinyHunters extortion group.
Optimizely claims that the attackers were unable to escalate privileges, install malware, or create persistent backdoors within the environment.
The company sent breach notification letters to impacted customers and is working to verify the full extent of the data theft. The company has not clarified whether they will provide credit monitoring services. Tt warned users to be careful of social engineering attempts that may use the stolen data to get passwords or MFA codes.
