ShinyHunters and ReliaQuest trade blows over claimed breach
The ransomware and extortion group ShinyHunters has claimed cybersecurity firm ReliaQuest as its latest victim, posting screenshots on its leak site purportedly showing access to the company's Okta identity dashboard. ReliaQuest has pushed back, confirming a social engineering attack occurred but insisting it was contained to briefly exposing a single employee's identity session, with no systems, applications or customer data compromised. The dispute follows earlier public sparring between the two, after ReliaQuest researchers highlighted ShinyHunters' use of fake company ".claims" domains in its phishing campaigns.
According to ReliaQuest's own account, attackers built a fake single sign-on page and phoned employees while posing as internal security staff; one employee entered their password and approved an MFA push, briefly handing over session access. The company says device-trust controls stopped the intruder reaching any real systems, and its security team promptly killed the session and reset the employee's credentials. No stolen data has been published, and threat intelligence firm SOCRadar found no validated samples, ransom demand or evidence of customer impact, leaving the row centred on how far the breach actually went rather than whether it happened at all.
- ShinyHunters claims ReliaQuest breach; firm disputes scope of access
- Attack via fake SSO page phished one employee's MFA session
- ReliaQuest says controls blocked further access; no data leaked
New here? Start with this
ShinyHunters is a criminal group that uses stolen account access and threats to publish data to pressure organisations. ReliaQuest is a cybersecurity company that helps businesses detect and respond to digital attacks.
The dispute centres on what attackers could reach after one employee was tricked into signing in to a fake company login page and approving a security prompt. Such prompts are designed to add a second check to a password, but an attacker who persuades someone to approve one may briefly gain access to their account session.
The claims matter because the two sides describe different levels of exposure, and a compromised employee session does not by itself show that company systems or customer information were accessed. The case also illustrates how attackers may impersonate trusted colleagues to get around security measures.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The screenshots showing Okta access constitute credible evidence of compromise: Okta controls SSO across an organisation's entire application estate, making even a briefly-exposed session extraordinarily serious and potentially more damaging than direct database access. ReliaQuest's characterisation as "contained" may reflect standard corporate crisis management rather than technical reality, given companies' powerful reputational and regulatory incentives to minimise breach severity. The absence of published data does not prove compromise didn't occur; threat actors often hold exfiltrated information as leverage before deciding whether to release it.
The case against
Device-trust controls are specifically engineered to prevent compromised session tokens being misused across an infrastructure, representing genuine architectural containment rather than mere claims. Independent threat intelligence firm SOCRadar found no evidence of data exfiltration, ransom demand or customer impact, providing third-party validation beyond company claims. The absence of any published data or follow-up ransom demand after weeks contradicts the operational patterns of genuine compromise.