ReliaQuest Says ShinyHunters-Linked Social Engineering Attack Had Limited Impact
Summary
ReliaQuest says a ShinyHunters-linked social-engineering attack tricked one employee into approving an SSO login, giving attackers brief view-only access to its identity dashboard; it says no business apps or data were accessed.
Key points
- ReliaQuest said attackers used a fake domain hosting a phishing page for its single sign-on system.
- The attackers called multiple employees, impersonating a security employee by name; the company also warned of legal-team impersonation in the wider campaign alongside IT and help desk impersonation.
- One employee entered a password and approved a push notification, giving the attacker a brief session on ReliaQuest’s identity dashboard.
- ReliaQuest said the attackers had view-only dashboard access and their attempts to reach business applications were denied by security controls.
- The company said no other identities, business applications, or customer or ReliaQuest data were accessed beyond the employee’s login credentials, and no persistence was established.
- ReliaQuest denied claims of ransomware targeting and said its applications, systems, and customer data were not compromised.
Article Details
- Victim Organization
- ReliaQuest
- Incident Type
- Social engineering attack involving an SSO phishing page, resulting in brief view-only access to an identity dashboard.
- Data Types Exposed
- One user's login credentials
- Affected Records
- One teammate's login credentials were entered.
- Operational Impact
- The attacker briefly obtained view-only access to ReliaQuest's identity dashboard. ReliaQuest said attempts to access applications from the dashboard were denied; no business applications were reached, no additional identities were accessed, and no persistence was established.
- Ransom Or Extortion
- ReliaQuest said claims that it was targeted by ransomware were false.
- Claim Status
- confirmed