INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ShinyHunters Breach Exposes ReliaQuest to Failed Data-Theft Attack

| 2026-08-24 15:17 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A social engineering attack was launched against ReliaQuest on August 24, 2026, targeting one of its employees. The attackers impersonated a security team member and tricked the employee into accessing a fake single sign-on page behind a content delivery network. This led to temporary view-only access to the employee's identity dashboard, but subsequent attempts were blocked by device-trust controls. No customer data was accessed or systems were compromised beyond the user's login credentials. The attackers did not establish persistence on ReliaQuest's systems and no other accounts, apps, or data were accessed.
Technical Mitigations AI-generated
• Use a domain verification technique to detect phishing attempts, such as verifying the domain of a login page before entering credentials. • Implement device-trust controls that block subsequent attempts to access applications through an identity dashboard after initial successful authentication. • Regularly audit control fidelity and on-network access for suspicious activity.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
re•••••.claims
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎2026/08/24
Threat actors used a phishing page hosted on the "lookalike domain" reliaquest.claims to target a real security employee, impersonating one of ReliaQuest's employees.
threat_actor ShinyHunters
In a new post on its extortion portal, ShinyHunters references ReliaQuest’s previous reporting on the threat group, saying "this time the post is about you , not us." ReliaQuest listed on the ShinyHunters extortion page Source: BleepingCompute…
" Last week, ReliaQuest's Threat Research team shared in a now-deleted post , that the ShinyHunters extortion gang was registering .claims domains to impersonate company's help desks and IT teams.
ShinyHunters claims the attack ReliaQuest’s statement comes shortly after the infamous data extortion group ‘ShinyHunters’ claimed an attack on the company.
Soon after, ShinyHunters published the same screenshots in a new entry on their data data leak site.
ReliaQuest confirms failed data-theft attack after ShinyHunters breach.
"ReliaQuest is tracking a widespread ShinyHunters campaign using domains that follow the company[.]claims pattern.
We asked ReliaQuest if the disclosed incident is linked to ShinyHunters, but we have not received any additional information yet.
However, ShinyHunters told BleepingComputer that their access was view only and did not reach any applications, systems, or customer data.
Intelligence Sources
BleepingComputer 2026-08-24