ShinyHunters-linked crews take Okta with a phone call and a rogue MFA device, Health-ISAC warns
Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.
The Engineer · Build desk
Key figures: the group extracted more than 200 million records from Salesforce and Snowflake. The published demand was 55 million US dollars. A home-health subsidiary disclosed 162,000 people affected after voice phishing in April.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Records extracted from Salesforce and Snowflake, over | 200,000,000 records | 5 | |
| Published demand | 55,000,000 US dollars | 18 | |
| People affected, home-health subsidiary | 162,000 people | after voice phishing in April | 8 |
What happened
- The first step was a call from someone posing as IT support, who got an employee to type their credentials and a one-time code into a fake single sign-on page.
- The operator used them to register a device it controlled as a second factor, then took control of the organisation's Okta identity platform.
- The published demand was 55 million US dollars, with more than 200 million records reportedly extracted from Salesforce and Snowflake.
- Halcyon's profile says the group's main chain relies on credential theft, social engineering and OAuth token abuse, with no CVEs attributed to it as of early 2026.
- A home-health subsidiary separately disclosed 162,000 affected people after a vishing call in April led to a third-party vendor platform.
Why it matters
- constraint A control keyed to file encryption or malware has no event to fire on here, so coverage has to come from identity and SaaS audit logs.
- exposure Identity provider, CRM, data warehouse and collaboration suite are usually federated, so one compromised identity reaches all four places where bulk records sit.
- cost Victims may learn of the breach only when they are named publicly, and cleanup is revocation and rotation followed by full breach response, with no key to buy.
Nothing in the flagship chain gives an encryption detector an event. The caller needed a story, a counterfeit single sign-on page and a one-time code the employee typed into it [3]. The enrolled device then made the attacker a second-factor holder on a real account [4]. After that, the write-up says, access was held by legitimate means, with no malware to remove and no decryption key to negotiate for [11].
The end of the chain is quiet too. MITRE's ATT&CK entry for the group records bulk export through compromised Salesforce dashboards [6]. According to the write-up, an export action from any of these platforms looks much like a reporting job [13]. In our view the export step is the hardest one to catch, because the detection has to explain why this session pulled this volume.
The write-up lists controls that map to specific hops. A FIDO2 key bound to the origin cannot be relayed to a counterfeit login page, so it breaks the opening step [14]. An alert on a newly enrolled authentication device on an existing account is, in the write-up's words, a compact, high-signal detection [15]. The export baseline is the weaker control. Data leaving a warehouse or CRM in unusual volumes is detectable only if a normal pattern has been defined [16]. Until someone defines it, the control has nothing to compare against.
The write-up's one vulnerability sits in a related case, not in the flagship chain. Attackers used a SQL injection flaw, CVE-2026-72898, in a self-hosted analytics platform to export order data on about 80,700 users of a hardware wallet vendor and its logistics partner [9]. The flaw was rated 10.0 and had a public patch [17].
All of this rests on one dev.to write-up of the warning. It says attribution within the ShinyHunters ecosystem is contested, and that the record counts and the demand figure rest on the attacker's own claims plus victim disclosures that vary in how complete they are [19]. The write-up does not name the organisation in the flagship case.
What to watch
- Whether victims' own disclosures confirm the 200 million record count and the 55 million dollar demand, which currently rest on attacker claims and uneven disclosures.
- Whether the Health-ISAC warning itself, not a secondary write-up, publishes indicators for rogue factor enrollment that defenders can alert on.
- Further vishing-led breach notices like the 162,000-person home-health case, which would show whether the pattern is spreading across vendor platforms.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In September 2026 Health-ISAC warned members about extortion activity carried out by ShinyHunters and clusters assessed to be associated with it.
- [2]
The campaigns combine voice phishing, credential theft and MFA bypass; in some cases operators registered their own authentication devices to hold the account; no file encryption was involved.
- [3]
In the flagship case an attacker called an employee posing as IT support and guided them to enter credentials and a one-time code into a counterfeit single sign-on page.
- [4]
With those credentials the operator enrolled an attacker-controlled device as a second factor and took the organisation's Okta identity platform.
- [5]
From Okta the path ran through federated services to Salesforce and Snowflake, from which the group extracted more than one terabyte of data and in excess of 200 million records.
- [6]
MITRE ATT&CK records that under Exfiltration Over Web Service, ShinyHunters used compromised Salesforce dashboards to export bulk data.
- [7]
Halcyon's profile of the group notes its primary attack chain relies on credential theft, social engineering and OAuth token abuse rather than vulnerability exploitation, with no CVEs attributed to its operations as of early 2026.
- [8]
A home-health subsidiary disclosed that 162,000 people were affected after attackers used voice phishing in April to obtain employee credentials and reach a third-party vendor platform.
- [9]
In a separate event involving a hardware wallet vendor and its logistics partner, attackers exploited a SQL injection flaw in a self-hosted analytics platform, CVE-2026-72898 (CVSS 10.0), created an administrator session and exported the order data of about 80,700 users.
- [10]
Encryption-based ransomware forces a decision quickly; exfiltration-first extortion forces none until the leak is announced, so the organisation may not know it is a victim until it is publicly named.
- [11]
Access is held by legitimate means, so there is no malware to remove and no decryption key to negotiate for; the only remediation is revocation and rotation, followed by the incident response of a data breach.
- [12]
Identity provider, CRM, cloud data warehouse and collaboration suite are the four places where bulk records accumulate, and for most enterprises they are federated so that one identity compromise grants access to all of them.
- [13]
An export action from any of these platforms looks much like a reporting job.
- [14]
A FIDO2 key bound to the origin cannot be relayed to a counterfeit login page, which breaks the opening step of this chain.
- [15]
A newly enrolled authentication device on an existing account is a compact, high-signal detection.
- [16]
Data leaving a warehouse or CRM in volumes that differ from the normal pattern is detectable if a normal pattern has been defined.
- [17]
CVE-2026-72898 was rated 10.0 and had a public patch.
- [18]
The published demand was 55 million US dollars.
- [19]
The warning attributes activity to a group that operates as a loose set of clusters, and attribution within that ecosystem is contested; reported record counts and the size of the demand come from the attacker's own claims and from victim disclosures of varying completeness.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toThe Ransom Note Without the Ransomware: Exfiltration-First Extortion in Healthcare
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Healthcare CybersecurityFollow
- Extortion Without EncryptionFollow
- Social Engineering and Voice PhishingFollow
- Identity SecurityFollow