30
42
30
30
30
30
30
30
42
30
30
30
30
55
60
42
30
30
30
30
55
30
42
30
30
30
30
42
30
ShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack
ShinyHunters mocked ReliaQuest after a fake-SSO social engineering call gave attackers brief view-only access to its identity dashboard via one employee.
ReliaQuest confirmed that on August 22, 2026, a caller posing as a named security team member directed an employee to a fake single sign-on page, capturing a password and an approved MFA push notification. The attackers, linked to extortion group ShinyHunters, obtained brief view-only access to the identity dashboard, with no applications, systems, or customer data reached and no persistence established. ShinyHunters posted screenshots claiming access to a ReliaQuest Okta SSO account on its leak site on August 23, contradicting the company's account. The incident followed ReliaQuest's warning about a ShinyHunters campaign using .claims TLD domains to impersonate legal, help desk, and IT staff.
55
30
57
30
30
42
30
55
30
30
45