Data BreachBleeping Computer
8.5 — CRITICAL
Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare
Health-ISAC is warning healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters, which are using social engineering to compromise single sign-on accounts and steal data from cloud services. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
ShinyHunters, an extortion gang, is conducting social engineering attacks on healthcare organizations using compromised single sign-on accounts to steal data from cloud services. The attacks follow a chain of voice phishing, password reset, and OAuth token compromise.
⚙️Technical Details
Affected Systems
OktaMicrosoft EntraGoogle SSOSalesforceMicrosoft 365SharePointDocuSignSlackAtlassianDropboxGoogle Drive
Attack Vectors
vishingpassword resetOAuth token compromise
💥Impact Assessment
Severity: critical
Who Is at Risk
Healthcare and medical technology organizations
🛡️Recommended Actions
1Require out-of-band identity verification for password resets, MFA resets, and device re-enrollment requests.
2Deploy phishing-resistant MFA, such as FIDO2 or WebAuthn security keys, for administrators, helpdesk personnel, executives, and other high-risk groups.
3Treat SSO systems as 'Tier 0' and require MFA and compliant devices when accessing sensitive cloud services.
📦Affected Products
Microsoft EntraGoogle SSOSalesforceMicrosoft 365SharePointDocuSignSlackAtlassianDropboxGoogle Drive
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.