Cybersecurity firm ReliaQuest has confirmed that one of its employees was compromised in a social engineering attack, leading to the temporary exposure of a single identity within the company's systems. The admission followed claims by the extortion group ShinyHunters, which posted screenshots on its leak site suggesting a more significant breach.
The incident unfolded on August 22, 2026, when attackers targeted ReliaQuest staff with a sophisticated phishing scheme. The threat actors created a convincing lookalike domain and a fraudulent single sign-on (SSO) page, which they concealed behind a content delivery network. They then initiated calls to multiple employees, impersonating a named member of the security team, and attempted to direct them to the fake login portal.
One employee ultimately entered their password and approved a multi-factor authentication (MFA) push notification on their device. This action granted the attackers a brief, view-only session within ReliaQuest's identity dashboard. However, the company stated that no ReliaQuest applications or systems were accessed, and no customer data was ever touched. Attempts by the threat actor to access further applications from the dashboard were consistently denied due to existing security controls.
ReliaQuest emphasized that the attack was contained because logging into its identity system does not automatically grant access to all other systems. Untrusted devices, regardless of valid credentials, were unable to reach the company's applications. Upon detection, ReliaQuest promptly terminated the attacker's session, enforced a password reset for the compromised account, and reset all associated authentication factors. The company asserted that no additional identities were accessed, no business applications were reached, no customer or ReliaQuest data was compromised beyond the initial login credentials, and no persistence was established. ReliaQuest explicitly denied claims of a broader compromise or ransomware targeting.
The incident was preceded by an unusual exchange on X (formerly Twitter). On August 17, ReliaQuest Threat Research posted a warning about a wider ShinyHunters campaign involving the registration of domains under the .claims top-level domain (TLD) and the group's expanded social engineering tactics, which included impersonating legal teams, help desks, and IT staff. In response, an account associated with the Odysseus Group replied with screenshots and a provocative message, "Who's hunting who?", implying that ReliaQuest researchers themselves had become targets. These posts were subsequently deleted.
On August 23, a listing naming ReliaQuest appeared on a ShinyHunters-associated leak site. The group's post, which included screenshots purporting to show access to a ReliaQuest Okta SSO account, stated, "This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away."
ReliaQuest acknowledged that even trained staff can be susceptible to social engineering, particularly when attackers possess prior knowledge, such as an employee's name. The company highlighted that the incident served as an important reminder of the persistent tactics employed by threat actor groups.
