ReliaQuest, a threat intelligence firm, has publicly refuted claims by the ShinyHunters threat group that its systems were compromised or subjected to a ransomware attack. The company confirmed it was targeted by a social engineering scheme on August 22, which briefly exposed its identity dashboard, but maintains that no applications, systems, or customer data were accessed.
The incident began to unfold on August 17 when ReliaQuest posted on X about a new ShinyHunters campaign utilizing ".claims" domains for social engineering. A member of ShinyHunters responded to this post with screenshots purporting to show ReliaQuest's Okta dashboard, accompanied by the message, "Who's hunting who?" While the exchange was subsequently removed from X, the screenshots reappeared on a ShinyHunters-affiliated leak site on August 23.
According to ReliaQuest's detailed account, the social engineering attack involved the threat actor registering a lookalike domain and setting up a fake ReliaQuest single sign-on (SSO) page, hosted behind a content delivery network. The attacker then called multiple ReliaQuest employees, impersonating a security team member by name, in an attempt to direct them to the fraudulent page. One employee entered their password and approved a push notification on their phone, which granted the attacker a brief session on the company's identity dashboard.
ReliaQuest emphasized that the access gained was "view only." The company stated that its defense-in-depth strategy, which assumes that phishing attempts will eventually succeed, includes controls such as device trust. These measures prevent non-ReliaQuest devices from accessing applications or systems. Furthermore, the company's containment actions promptly terminated the attacker's sessions, expired the compromised password, and reset all authentication factors.
ReliaQuest explicitly denied any claims of a broader compromise or a ransomware attack, labeling them as "false." This assessment is supported by analysis from SOCRadar, which reviewed the ShinyHunters posts and concluded that while they demonstrated pressure tactics and public taunting, they did not substantiate a breach claim or prove access to ReliaQuest networks.
