Intruders at Genesys got into the systems the call-center vendor uses to run its own business, not the platforms its clients rely on, according to the company. The Menlo Park firm said on October 19 that a learning management system and a customer relationship management environment had been reached, then reported on October 23 that it had stopped the activity.
Its three service platforms were untouched: Genesys Cloud, Genesys Engage and Genesys Engage Cloud. Customer and partner records held inside them were not affected either. The data that did move was the sales-side picture of who its customers are, spanning names, phone numbers, work email addresses, job titles, company information and account details.
Containment and an unconfirmed claim
Shutting the learning system down was part of the response. Genesys says the review is not finished and that it will share more once items are verified, and it asked clients to be wary of unsolicited messages that appear to come from the firm. It has not blamed anyone, though a crew that surfaced recently as ScarlettGroup has posted a claim about the intrusion on its leak site.
What it says about supplier risk
Customer experience vendors sit on a great deal of relationship data, and the back-office tools that carry a sales pipeline usually get looser governance than the production platform handling regulated traffic. Two questions are worth putting to any supplier like this: did the breached environment hold your account contacts, and does the contract force notice when the system that fell was a support tool rather than a service platform?
Treat any message citing a recent vendor incident as a likely impersonation attempt. A roster of known customer contacts is precisely what a phisher needs.
