The phone call behind 2026’s biggest breaches

Many of the largest data thefts of the past year didn’t start with clever code. They started with a phone call. Someone rings an employee, says they’re from the IT department, and walks them through “updating their security settings.” A few minutes later, the caller has that employee’s sign-in, and through it, a company’s customer records.

How the calls work

In January 2026, Google’s Mandiant team described a wave of these attacks, which it links to groups using the ShinyHunters name. The callers:

1. pretend to be IT staff and say the company is updating multi-factor authentication
2. send the employee to a convincing look-alike sign-in page with the company’s branding, at addresses built from the company name plus words like “sso” or “internal”
3. capture the password and the one-time code as the employee types them
4. register their own device for multi-factor, so they keep access afterwards

From there, they help themselves to whatever that one sign-in can reach, often several cloud services at once: Salesforce, SharePoint, OneDrive, Slack, document-signing tools. In one case, Mandiant saw the attackers delete the “new security method enrolled” email so the employee wouldn’t notice. Then come the extortion emails, typically with a 72-hour deadline.

Mandiant is explicit that this is “not the result of a security vulnerability in vendors’ products.” It’s social engineering, and it works.

A second door: connected apps

Microsoft reported in July 2026 on a related approach seen from mid-2025 to mid-2026. Callers talked employees into approving a malicious app, disguised as a legitimate Salesforce data tool, that then pulled customer records through approved channels. Attackers also stole the access keys of third-party tools that plug into Salesforce, so the data theft looked like normal integration traffic.

Why this reaches you

You never got the call, but your data sat in the systems behind it: customer records, support tickets, appointment details. Some examples from 2026:

• McKesson, the health care distributor, disclosed a breach after ShinyHunters claimed to have stolen patient-related records. The group told BleepingComputer it got in by voice-phishing employees and taking over their Okta single sign-on accounts. Those are the group’s claims; BleepingComputer notes that its record count does not mean that many patients were affected.
• Instructure’s Canvas, used by universities across Canada, was breached a different way, through a flaw in its free teacher accounts, by the same extortion group. We covered what Canvas users should know.

Not every breach in this wave has a confirmed method, and we won’t guess. The pattern is clear enough: the weakest link was a person being rushed on the phone.

What actually stops it

For companies, the answer Mandiant points to is phishing-resistant sign-in: FIDO2 security keys or passkeys, which “are resistant to social engineering in ways that push-based or SMS authentication are not.” A passkey only works on the real site, so there’s nothing for a caller to collect.

For you, the same idea helps at home:

• Use passkeys on accounts that offer them. A scam page can’t use them.
• Never read a code to someone who called you. Not to “IT,” not to your bank, not to us. Hang up and call back on a number you look up yourself.
• Expect the follow-up. After a breach, the stolen details get used to make scam calls and emails more believable. A caller who knows your name, address and last order isn’t proof of anything.

Sources

• Google Cloud / Mandiant, Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft, January 30, 2026
• Microsoft Security, Defending SaaS-based applications against ShinyHunters OAuth abuse, July 13, 2026
• BleepingComputer, McKesson discloses breach after ShinyHunters claims patient data theft
• BleepingComputer, Instructure reaches “agreement” with ShinyHunters to stop data leak