Health-ISAC Warns of Rising ShinyHunters Attacks on Healthcare
Summary
Health-ISAC warns of rising ShinyHunters attacks on healthcare and medtech organizations, involving vishing, phishing and SSO account takeover to access cloud data. It recommends stronger helpdesk checks, phishing-resistant MFA and cloud activity monitoring.
Key points
- Health-ISAC reports an increase in successful ShinyHunters attacks against healthcare and medtech organizations; its advisory gives no incident count or timeframe.
- The described attack chain uses vishing and phishing to manipulate employees or helpdesk staff into resetting passwords, changing MFA or enrolling devices.
- Compromised SSO accounts can provide access to connected SaaS services and cloud data; the article names Microsoft Entra, Salesforce, Microsoft 365 and SharePoint.
- Health-ISAC says ShinyHunters claimed to have compromised an Entra SSO account and stolen data from enterprise platforms, but cautions that not every data-theft claim is verified.
- BleepingComputer says it is aware of recent attacks involving Medtronic, DentaQuest, iRhythm and OneMedical; the advisory does not identify affected organizations.
- Recommended defenses include verified callbacks and approval for helpdesk resets, a no-same-call reset policy, and phishing-resistant MFA for high-risk users.
- Health-ISAC also recommends monitoring identity and SaaS logs for new MFA factors, suspicious OAuth grants and bulk downloads, and preparing to revoke sessions and credentials.
Article Details
- Event Type
- Health-ISAC warning about increased ShinyHunters identity and supply-chain attacks against healthcare and medical technology organizations
- Impact
- The reported attacks use vishing and phishing to compromise SSO accounts and access connected cloud services, enabling data theft and potential extortion. Health-ISAC reports an increase in successful attacks but does not disclose the number of incidents or identify affected organizations; some ShinyHunters data-theft claims remain unverified.
MITRE ATT&CK
T1078 · Valid AccountsAttackers reportedly use compromised SSO accounts to access connected SaaS applications.T1530 · Data from Cloud StorageThe reported activity includes stealing data from connected cloud services and storage platforms.T1566.004 · Spearphishing VoiceThe advisory describes voice phishing (vishing) used to manipulate employees or helpdesk personnel into resetting passwords or changing MFA.
Threat Actors
Vendors
GoogleOnce they gain access to an account, they log in to an organization’s Okta, Microsoft Entra, or Google SSO dashboard, which acts as a centralized hub listing all SaaS applications the user has permission to access.MicrosoftThe group has targeted platforms such as Microsoft Entra, Salesforce, Microsoft 365, and SharePoint, with recent activity linked to organizations including Medtronic, DentaQuest, iRhythm, and OneMedical.OktaOnce they gain access to an account, they log in to an organization’s Okta, Microsoft Entra, or Google SSO dashboard, which acts as a centralized hub listing all SaaS applications the user has permission to access.SalesforceThe group has targeted platforms such as Microsoft Entra, Salesforce, Microsoft 365, and SharePoint, with recent activity linked to organizations including Medtronic, DentaQuest, iRhythm, and OneMedical.SnowflakeThese breaches give them access to OAuth tokens that are used to integrate with SaaS providers like Salesforce and Snowflake.
Products
AtlassianThese applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.DocuSignThese applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.Dropbox DocSendThese applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.Google DriveThese applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.Microsoft 365 Apps for EnterpriseThe group has targeted platforms such as Microsoft Entra, Salesforce, Microsoft 365, and SharePoint, with recent activity linked to organizations including Medtronic, DentaQuest, iRhythm, and OneMedical.Microsoft EntraThe group has targeted platforms such as Microsoft Entra, Salesforce, Microsoft 365, and SharePoint, with recent activity linked to organizations including Medtronic, DentaQuest, iRhythm, and OneMedical.Microsoft SharePointThe group has targeted platforms such as Microsoft Entra, Salesforce, Microsoft 365, and SharePoint, with recent activity linked to organizations including Medtronic, DentaQuest, iRhythm, and OneMedical.OktaOnce they gain access to an account, they log in to an organization’s Okta, Microsoft Entra, or Google SSO dashboard, which acts as a centralized hub listing all SaaS applications the user has permission to access.SalesforceThe group has targeted platforms such as Microsoft Entra, Salesforce, Microsoft 365, and SharePoint, with recent activity linked to organizations including Medtronic, DentaQuest, iRhythm, and OneMedical.SlackThese applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.SnowflakeThese breaches give them access to OAuth tokens that are used to integrate with SaaS providers like Salesforce and Snowflake.
Industries
HealthcareHealth-ISAC is warning healthcare and medtech organizations about a rise in successful ShinyHunters attacks that use vishing, phishing, and supply chain compromise to take over SSO accounts and steal cloud data.medical technologyHealth-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters.