ShinyHunters

In July 2026, the ShinyHunters extortion group breached RingCentral through a sophisticated social engineering campaign, exfiltrating personal information from 1.6 million customer accounts. The stolen data included names, email addresses, phone numbers, and physical addresses. After RingCentral refused to pay a ransom, ShinyHunters leaked a 280GB compressed archive of the stolen data on their dark web leak site. The breach did not impact RingCentral's core platform, and no further unauthorized activity has been observed since remediation efforts were implemented.

Trezor disclosed a data breach affecting nearly 14,000 customers due to a compromise of its shipping provider, ShipMonk, which was breached via a zero-day SQL injection vulnerability in the analytics platform Metabase. The attackers accessed customer order data including names, email addresses, phone numbers, and shipping addresses. ShipMonk confirmed the breach stemmed from exploitation of a critical vulnerability in Metabase, which was also used to attack other companies like Framework and Tally. Trezor emphasized that its own systems were not compromised and device security remains intact, but warned affected users of increased phishing risks. The ShinyHunters extortion group has claimed responsibility, sending extortion emails to ShipMonk.

The City-Forum data theft campaign targets misconfigured Salesforce Experience Cloud and ServiceNow portals by exploiting overly permissive guest user access. Attackers use a single server at IP 158.220.87.79 to enumerate and steal data exposed to unauthenticated users via custom techniques on both legacy Aura and newer Lightning Web Runtime (LWR) frameworks in Salesforce, as well as the ServiceNow Service Portal search API. The campaign has been active since at least March 2025, with increasing activity across multiple sectors including finance, telecom, and public-sector organizations. No vulnerability is exploited; instead, the theft relies on misconfigurations that allow public access to sensitive records.

UNC6671, a financially motivated threat actor group, is conducting vishing attacks to steal credentials and multi-factor authentication tokens by impersonating IT help desk personnel and contacting employees on their personal mobile devices. The attackers use adversary-in-the-middle (AitM) infrastructure to capture credentials and session tokens, enabling access to SaaS platforms such as Microsoft 365 and Okta. The group operates under multiple extortion brands including Redact, Pink, Helix, and Falcon, and has exfiltrated data from organizations in North America, Australia, and the U.K., collecting over $10.6 million in Bitcoin between January and May 2026. Google and CrowdStrike assess that the group leverages social engineering rather than technical vulnerabilities, highlighting the need for phishing-resistant MFA and improved session controls.

The Greatness phishing-as-a-service (PhaaS) platform has evolved to conduct adversary-in-the-middle and device-code phishing attacks, primarily targeting Microsoft 365 accounts. It abuses the trusted reputation of RingCentral by spoofing emails from service@ringcentral[.]com, using lures like fake voicemail and performance review notifications to bypass email filters. Victims are redirected to phishing pages that capture MFA-approved tokens, enabling persistent access to mailboxes, Teams, SharePoint, and other Microsoft 365 services. The attackers may have leveraged data from a recent RingCentral breach to target legitimate users.

ShinyHunters, a known extortion gang, claimed responsibility for a breach of Brinks Home on July 13, 2026, asserting they stole over 4.9 million Salesforce records containing personally identifiable information (PII) via a Microsoft Entra voice phishing (vishing) attack. The attackers reportedly exfiltrated more than 1.1 million customer data rows from the 'Contacts' Salesforce object, over 4,000 employee PII records, and 3.8 million customer support chat logs from a Brinks Care Cresta instance. Brinks Home confirmed the breach and an ongoing investigation, noting that alarm monitoring systems were unaffected, but warned customers of potential phishing and impersonation attacks stemming from the incident.

Health-ISAC has issued an advisory warning healthcare and medical technology organizations about a rise in ShinyHunters' data theft operations targeting cloud SaaS and identity systems. ShinyHunters conducts vishing and phishing attacks to compromise single sign-on (SSO) accounts, particularly Microsoft Entra, Okta, and Google SSO, enabling access to critical platforms like Salesforce, Microsoft 365, SharePoint, and Dropbox. Once inside, attackers steal large volumes of data for extortion purposes. The advisory emphasizes the need to secure helpdesk procedures, enforce phishing-resistant MFA, and monitor SSO and cloud service logs to detect account takeovers and data exfiltration.

The ShinyHunters extortion gang has claimed responsibility for the recent data breach at Ernst & Young (EY), asserting they obtained EY credentials through a supply-chain attack. The attackers allegedly accessed EY's Jira, GitHub, and Azure environments and exfiltrated documents containing client tax, personal, and financial information. EY detected suspicious activity between March 28 and April 12, 2026, and confirmed unauthorized access to a third-party support ticket system, though it has not verified ShinyHunters' involvement. The gang is threatening to release stolen data unless contacted by July 31, 2026.

Threat actors are leveraging email addresses and company breach data leaked by the ShinyHunters extortion group to conduct a sextortion email campaign. The emails falsely claim that recipients' devices were compromised and threaten to release intimate videos unless $2,000 in Bitcoin is paid. The campaign uses legitimate breach details to appear credible, but there is no evidence of actual device compromise. ShinyHunters has denied involvement in the scam.

Abbott Laboratories is investigating two unrelated cyber incidents. The first involves the ShinyHunters extortion gang, which claims to have accessed legacy Exact Sciences systems via a vishing attack compromising Microsoft Entra SSO credentials, exfiltrating sensitive customer and internal data. The second incident involves a threat actor named ShadowByt3$, who claims unauthorized access to Abbott's LabCentral portal using compromised customer credentials, allegedly stealing technical and regulatory documents. Abbott states that no critical operations were impacted and disputes claims that sensitive data was exposed in the LabCentral incident.