Logitech customer data exposed in zero-day flaw cyberattack

Peripheral and hardware giant Logitech has disclosed a cybersecurity incident involving unauthorized access to its internal IT systems, resulting in the exfiltration of sensitive data.

The company confirmed that the breach involved data from some employees, customers, and suppliers, but noted that its product lines, business operations, and manufacturing systems were not affected.

The breach was disclosed in a Form 8-K filing with the US Securities and Exchange Commission on November 14, 2025. According to Logitech, the attack was facilitated by a zero-day vulnerability in an unnamed third-party software platform. The company reports that it applied a patch after the vendor released a fix, but not before attackers exploited the flaw to access and copy unspecified internal data.

The ongoing investigation is being conducted with assistance from unnamed external cybersecurity firms. Logitech has not identified the threat actor behind the intrusion, nor has it specified the volume or nature of the compromised data beyond noting it included “limited information” related to employees, consumers, customers, and suppliers. Crucially, the company believes that no highly sensitive personal information, such as credit card details or national ID numbers, was stored on the affected systems.

Although not officially confirmed, the incident bears the hallmarks of Cl0p ransomware attacks leveraging CVE-2025-61882, a zero-day flaw in Oracle EBS, that has impacted multiple organizations, including the Washington Post recently.

Headquartered in Lausanne, Switzerland, with operational headquarters in San Jose, California, Logitech is a major player in the global computer accessories market. Its product portfolio includes mice, keyboards, webcams, and other input devices, widely used across consumer, enterprise, and gaming sectors. The firm is publicly traded on both the SIX Swiss Exchange as LOGN and the Nasdaq Global Select Market as LOGI.

At this stage, Logitech asserts that the cyber incident is not expected to have a material adverse effect on its financial condition or business results. The company also noted it maintains a cybersecurity insurance policy that is expected to cover various costs arising from the incident, including forensic investigations, legal fees, regulatory actions, and any business interruptions, subject to policy limits and deductibles.

The 8-K filing emphasizes that the situation remains fluid, as the scope and impact of the cybersecurity incident are still being assessed. New information could surface as the forensic investigation progresses, potentially altering the current understanding of the breach’s severity.