Breaches and incidentsBriefReported by a reputable outlet, citing the company
ShinyHunters SSO vishing campaign against Okta and other identity providers (Crunchbase confirmed)
Mandiant (30 Jan 2026) reported an expanding ShinyHunters-branded campaign that uses voice phishing plus lookalike credential sites (for example...
- Disclosed
What happened
- Mandiant (30 Jan 2026) reported an expanding ShinyHunters-branded campaign that uses voice phishing plus lookalike credential sites (for example <company>sso.com) to collect SSO credentials and MFA codes, enrol attacker MFA devices, then pivot into SaaS apps and exfiltrate data for extortion. Silent Push listed 100+ targeted Okta SSO accounts; being listed does not mean breached. Crunchbase confirmed a threat actor exfiltrated documents from its corporate network; ShinyHunters claims 2M+ records and posted 400MB of files.
- Root cause: social engineering of employees; Mandiant says “these compromises did not result from security vulnerabilities in the vendors’ products or infrastructure.”
- Attributed by Mandiant to ShinyHunters-branded activity; Silent Push attributes to the wider Scattered LAPSUS$ Hunters cluster.
- Okta issued a customer alert; Crunchbase engaged experts and federal law enforcement.
Sources
- https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft
- https://www.securityweek.com/crunchbase-confirms-data-breach-after-hacking-claims/
- https://www.theregister.com/2026/01/26/shinyhunters_okta_sso_campaign/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.