The threat involved a social engineering attack targeting ReliaQuest employees, where attackers impersonated security personnel and used a lookalike domain to host a fake SSO login page. One employee fell for the phishing attempt, providing credentials and approving an MFA push, which gave attackers temporary, view-only access to ReliaQuest’s Okta identity dashboard. Despite this, device-trust controls blocked attempts to access applications or customer data. ReliaQuest terminated the attacker’s sessions, reset credentials, and found no evidence of further compromise or persistence. The ShinyHunters extortion group claimed responsibility and confirmed the limited scope of access.

The attacker gained temporary, view-only access to an identity dashboard but was blocked from accessing any applications, systems, or customer data. No data theft or persistence was detected. The incident did not result in compromise of ReliaQuest’s internal systems or customer information.

ReliaQuest’s existing device-trust controls and session management successfully prevented escalation beyond view-only access. The company terminated attacker sessions, revoked compromised credentials, and reset authentication tokens. No further action is indicated as the attack was contained and no data was accessed. Organizations should remain vigilant against social engineering and phishing attempts, especially those involving MFA approval prompts.