ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited

The threat actor affiliated with ShinyHunters executed a social engineering phishing attack against ReliaQuest by registering a fake domain hosting a single sign-on (SSO) phishing page. They impersonated security employees to convince a ReliaQuest teammate to enter their password and approve a push notification, which allowed the attacker brief view-only access to the company's identity dashboard. Despite attempts, the attacker was unable to access applications, customer data, or establish persistence due to existing security controls. ReliaQuest confirmed no business applications or customer data were compromised and refuted claims of ransomware involvement.

The attacker gained only limited, view-only access to an identity dashboard for a brief period. No customer data, business applications, or additional user identities were accessed. No persistence or further compromise was established. The incident did not result in a ransomware attack or broader system compromise. The impact was therefore limited to a single user’s credentials and a short session with restricted access.

ReliaQuest has not indicated any required action beyond their existing security controls, which successfully prevented further access. The incident highlights the importance of vigilance against social engineering and phishing attacks. Organizations should continue to enforce multi-factor authentication and educate employees on phishing risks. Patch status is not applicable as this is a social engineering attack rather than a software vulnerability.