10/14/2025 | Press release | Distributed by Public on 10/14/2025 18:11
WASHINGTON - U.S. Senator Bill Cassidy, M.D. (R-LA), chair of the Senate Health, Education, Labor, and Pensions (HELP) Committee, raised concerns over recent cybersecurity vulnerabilities affecting Cisco, the largest provider of network infrastructure in the world. This comes after the Cybersecurity and Infrastructure Security Agency (CISA) directed federal agencies to quickly disconnect from certain Cisco devices due to an active cybersecurity threat.
Cybersecurity vulnerabilities affecting Cisco's systems are a grave national security threat and have the potential to impact nearly every federal agency and business in the United States, exposing Americans' data to attacks from hostile actors like China, Russia, and Iran.
"As cyber incidents continue to increase, it is essential that the public and private sector take steps to safeguard the information of millions of patients, students, and employees across America," wrote Dr. Cassidy. "These efforts also are critical to protect our national security interests."
Read the full letter here or below.
Dear Mr. Robbins,
Cybersecurity incidents pose a substantial threat to the American economy and the consumer. In 2024, the Federal Bureau of Investigation (FBI) estimated that cyber crimes resulted in over $16 billion in losses.1 The Senate Committee on Health, Education, Labor, and Pensions (HELP) is conducting an investigation of these challenges and an assessment of initiatives underway to respond.
As cyber incidents continue to increase, it is essential that the public and private sector take steps to safeguard the information of millions of patients, students, and employees across America. These efforts also are critical to protect our national security interests. The emergency directive issued by the Cybersecurity and Infrastructure Security Agency (CISA) on September 25 directed federal agencies to disconnect certain Cisco devices from federal systems in just one day in response to evidence of an active cybersecurity threat. 2 Recent reports indicate at least one federal agency has already been breached as a result of this vulnerability. This incident highlights the growing threat of sophisticated attacks from hostile actors, such as China, Russia, and Iran.
As the largest provider of network infrastructure in the world, Cisco holds a unique position in delivering tools not only to the federal government, but virtually all businesses. These tools connect consumers and businesses to care services, educational tools, and platforms businesses need to operate. Any vulnerability in Cisco's systems would jeopardize this access for millions of Americans.
As Cisco works with the federal government to patch any cybersecurity vulnerabilities, it must work with these stakeholders to ensure their systems are protected as well. To that end, I request answers to the following questions by October 27, 2025:
Has Cisco identified any specific threats to individual customers? If so, how is it communicating next steps or security patches?
How is Cisco proactively communicating with customers as Cisco identifies more about the potential threat?
Is Cisco currently recommending that individual customers disconnect or upgrade end-of support devices as CISA directed federal agencies do on September 25?3
How is Cisco engaging with specific federal agencies, including the Departments of Education, Labor, and Health and Human Services to provide sector-specific services or assistance to impacted entities?
Estimates are that 45% of companies in the United States do not employ a Chief Information Security Officer (CISO).4 How is Cisco working to communicate with individual customers, specifically health care providers, schools, and small businesses, to ensure they have current information about ways to address any cybersecurity vulnerabilities?
Sincerely,
###
For all news and updates from HELP Republicans, visit our website or Twitter at @GOPHELP