INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ShinyHunters Breach ReliaQuest

| 2026-09-03 19:42 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A breach of ReliaQuest's Okta portal by a threat actor associated with ShinyHunters was reported, but the incident appears to be more of a social engineering attempt than a full-scale breach. On September 3, 2026, an employee at ReliaQuest entered their credentials into a fake single sign-on (SSO) page, allowing the attacker to gain view-only access to the SSO portal and thwart attempts to access applications or move laterally. The incident was publicly boasted about by ShinyHunters, but it is unclear if they actually breached ReliaQuest's systems. Two alleged members of TeamPCP gang were identified and arrested in Western Australia on September 3, 2026.
Technical Mitigations AI-generated
• Use multi-factor authentication for single sign-on (SSO) portals to prevent attackers from gaining access. • Implement zero-trust security policies to limit lateral movement and restrict access to sensitive areas of the network after a breach occurs. • Regularly monitor Okta accounts for suspicious activity, such as spoofed company domains or unauthorized login attempts.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHuntersTeamPCPTeamPCP Shai-HuludShai-Hulud
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DPRK DPRK
Incident Timeline
‎2026/09/03
A threat actor associated with ShinyHunters posted on social media platform X, saying "Who's hunting who?" and containing a photo of an Okta portal.
threat_actor ShinyHunters
Last week, the cybersecurity vendor warned of a "widespread ShinyHunters campaign" using spoofed company domains in a now-deleted post on social media platform X. A account associated with ShinyHunters replied with a post that said "Who's hunting w…
What We Missed: Did ShinyHunters 'Breach' ReliaQuest?.
ShinyHunters publicly boasted about breaching ReliaQuest, but the claims appear to be mostly hot air.
In this episode of "What We Missed," Dark Reading's Rob Wright and Alex Culafi discuss some of the recent news events and topics that didn't make it into the publication, starting with ShinyHunters ' taunting of ReliaQuest.
threat_actor TeamPCP
…ase Also discussed on this episode: New research from Palo Alto Networks' Unit 42 indicates that AI-generated malware isn't a prevalent threat — at least, not yet; and two alleged members of the infamous TeamPCP gang were identified and arrested.
Was it TeamPCP?
Is TeamPCP even a thing?
Intelligence Sources
Dark Reading 2026-09-03