Ericsson US Discloses Data Breach – Hackers Stolen Employees and Customers Data

The U.S. subsidiary of a Swedish telecommunications multinational has disclosed a data breach exposing the personal information of employees and customers.

The incident did not occur on Ericsson’s internal network, but rather targeted one of the company’s third-party service providers.

According to the breach notification letter, the unauthorized access occurred over a five-day window between April 17, 2025, and April 22, 2025.

Ericsson Data Breach

The compromised service provider first detected the suspicious network activity on April 28, 2025.

External reports indicate the breach was the result of a “vishing” (voice phishing) attack, where threat actors used a phone-based social engineering scam to compromise a vendor employee’s account.

Following the discovery, the service provider launched an immediate investigation and hired external cybersecurity forensics specialists to determine the scope of the intrusion.

Because of the complexity of the data, the comprehensive review process took several months.

Investigators officially concluded their review on February 23, 2026, confirming that files containing sensitive personal data belonging to Ericsson were accessed. In total, the breach impacted 15,661 individuals.

While the notification letter primarily mentions the exposure of names, regulatory filings reveal a broader scope of compromised data.

The stolen information may include :

• Addresses
• Social Security Numbers
• Government-issued IDs
• Financial account information
• Medical records
• Dates of birth

Fortunately, Ericsson and its vendor stated that there is currently no evidence that the stolen information has been misused in the wild since the breach.

In response to the security incident, the affected service provider took several critical steps to secure its infrastructure and mitigate further risks.

The vendor forced password resets, deployed enhanced network security measures, and notified the Federal Bureau of Investigation (FBI) to assist with tracking the threat actors.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.