ShinyHunters and ReliaQuest trade blows over claimed breach
- ID
- 17256
- Status
- summarized
- Published
- 24 Aug 2026, 10:01 PM
- Fetched
- 24 Aug 2026, 10:55 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/24/shinyhunters-and-reliaquest-trade-blows-over-claimed-breach/5291702
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 4.5
- Created
- 24 Aug 2026, 10:56 PM
- Tags
- Audience
- developerssaas_founders
What happened
ShinyHunters listed ReliaQuest on its leak site on August 23, claiming access via screenshots of ReliaQuest's Okta dashboard. ReliaQuest confirmed a social engineering attack on August 22 involving a fake SSO page and an MFA push approval, but says device-trust controls blocked the attacker from reaching any applications or customer data, and the session was killed within the identity layer.
Why it matters
If you run SSO with Okta or similar, this is a concrete example of why device-trust controls matter: the attacker got a valid identity session via a fake login page plus MFA push, but couldn't pivot because device posture was enforced. Review whether your IdP blocks session use from unmanaged or non-compliant devices, and whether your team would catch an MFA-push social-engineering call in real time.
Discussion angle
The attack chain here is cheap and replicable—fake SSO page + phone call impersonating security team + MFA push—so the interesting question is what stopped it: device-trust enforcement at the IdP level. Worth discussing whether your own SSO setup would contain this or let the session walk into production.