Shiny Hunters Data Breach vs. SaaS: Why Dynamic Security Matters
Summary: ShinyHunters, a cybercrime group monetizing stolen data since 2020, shifted from credential and database theft to social engineering, using vishing and fraudulent OAuth access to breach Salesforce environments at Google, Workday, Pandora, Cisco, Chanel and others in mid-2025. In the June 2025 Google incident attackers talked an IT service desk into resetting a Salesforce password, and Workday discovered on August 6 that attackers posing as internal HR on the phone had accessed a customer support database of business contact information.
Key Takeaway: No malware or zero-day was needed: one convincing phone call and one authorized fake connected app were enough to reach customer data inside Salesforce, and ShinyHunters has boasted of using AI-generated voices to mask identities. The breach path ran through people and OAuth grants, not infrastructure, so the controls that matter are the ones watching who authorizes what.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026