Health-ISAC issued a cybersecurity alert in July 2026 warning health sector organizations about a rise in successful attacks by ShinyHunters, a group that steals data and extorts payment rather than encrypting systems. There is no ransomware note, no locked workstation, and no downed EHR. The first sign is usually a message telling you the data is already gone. The activity described here was documented by The HIPAA Journal.

The group runs supply chain and identity attacks against cloud SaaS and storage platforms, with the goal of cloud-scale data exfiltration. Initial access typically comes from voice-based social engineering (vishing), where a caller talks a helpdesk or IAM support agent into resetting a password, resetting MFA, or enrolling a new device on the attacker's behalf.

Once they hold the account, they sign in to the organization's Okta, Microsoft Entra, or Google SSO dashboard. That dashboard lists every application the account holder can reach, including Microsoft 365, Salesforce, Dropbox, Google Drive, and other third-party platforms. For your practice, that single compromised identity is a directory of where the patient records, claims data, and customer files live.

Data is pulled out quickly, and the victim is then notified of the theft and asked to pay to keep the files off the group's dark web leak site.

In a recent attack on a health sector organization, ShinyHunters claimed to have run vishing calls against multiple employees, compromising a Microsoft Entra account and exfiltrating a significant amount of company data from SaaS and internal platforms including Microsoft 365 and SharePoint.

Recent healthcare and medtech victims named in the alert include the medical device manufacturers Medtronic and iRhythm, along with OneMedical, DentaQuest, AdaptHealth, and Him & Hers. The range covers device makers, primary care, dental benefits, home medical equipment, and telehealth, so the common factor is not your clinical specialty. It is that your workforce authenticates through SSO into cloud applications holding regulated records.

How ShinyHunters Gains Access: Voice Phishing and SaaS Data Theft

The attack chain runs from a phone call to a cloud tenant in a single session. The caller reaches helpdesk or IAM support, works through the identity verification questions, and asks for a password reset, an MFA reset, or enrollment of a new device. Health-ISAC's alert notes that in one recent health sector incident, ShinyHunters claimed to have vished multiple employees before a Microsoft Entra account was successfully compromised.

What makes this efficient is what happens immediately after authentication. Logging into an Okta, Entra, or Google SSO dashboard hands the attacker a complete inventory of every application that account can reach, including Microsoft 365, Salesforce, Dropbox, Google Drive, and any other federated third-party platform. No network scanning, no lateral movement, no privilege escalation chain. The dashboard does the reconnaissance.

From there the activity is bulk data access at cloud speed. In the incident Health-ISAC described, data was pulled from SaaS and internal platforms including Microsoft 365 and SharePoint. The alert's detection guidance points to the specific behaviors that accompany this stage, which tells you what the group actually does once inside:

• New device enrollments and MFA factor registrations that establish durable access independent of the original stolen password
• New OAuth applications and unusual consent grants, which give an attacker-controlled app programmatic access to mailboxes and files that survives a password change
• Unusual bulk downloads and atypical API calls against document repositories and CRM data
• New mail forwarding rules and mailbox delegation changes for ongoing collection

Mapped to MITRE ATT&CK, the chain is roughly T1566.004 (Phishing: Voice) for initial contact, T1098.005 (Account Manipulation: Device Registration) and T1556.006 (Modify Authentication Process: Multi-Factor Authentication) for the reset abuse, T1078.004 (Valid Accounts: Cloud Accounts) for the SSO login, T1528 (Steal Application Access Token) and T1550.001 (Use Alternate Authentication Material: Application Access Token) for the OAuth pivot, and T1530 (Data from Cloud Storage) plus T1114.003 (Email Forwarding Rule) for collection.

Endpoint tooling has almost nothing to inspect here. Nothing is dropped to disk, no process is injected, no command shell runs on a managed laptop. The traffic is authenticated HTTPS and API calls to sanctioned cloud services, made with credentials the identity provider considers valid and a device the tenant now trusts because it was enrolled through an approved reset workflow. An agent watching for malicious binaries will not flag a session that the identity system itself blessed.

The business consequence is that the compromise is invisible to the controls most healthcare organizations trust most, and the first indication is a ransom demand backed by a threat to publish the stolen records on the group's data leak site. Because the target is patient, employee, and business data rather than availability, clinical systems keep running while the exposure event has already completed.

The named victims illustrate the range. ShinyHunters has successfully attacked medical device manufacturers Medtronic and iRhythm, along with OneMedical, DentaQuest, AdaptHealth, and Him & Hers. Device makers, benefits administrators, home medical equipment suppliers, and telehealth providers all hold large SaaS-resident data sets, and all of them sit upstream of provider organizations that share data with them.

Consequences for Patient Data, HIPAA Exposure and Extortion Demands

The data ShinyHunters takes from a health sector tenant is not limited to clinical records. Cloud storage and SaaS platforms hold the working material of the whole organization, which means an exfiltration event pulls in far more than what sits in your EHR.

Depending on what your staff store in Microsoft 365, SharePoint, Salesforce, Dropbox, and Google Drive, a single compromised account can expose:

• Protected health information in spreadsheets, care coordination files, and referral documents that were exported from clinical systems for routine work
• Insurance, eligibility, and billing records, including claims data and payment details tied to named patients
• Employee PII and HR files, which carry the same notification consequences as patient data under state law
• Clinical trial, device engineering, and research data for medtech and life sciences firms, where the loss is competitive as well as regulatory
• Contracts, vendor agreements, and internal correspondence that reveal your partners and your negotiating position

The extortion model works differently from encryption. There is no decryption key to buy, so what you are being sold is silence, and the group's dark web leak site is the enforcement mechanism. Paying does not return the data or remove your legal obligation to report it.

ShinyHunters contacts victims directly after exfiltration, and pressure tends to land on executives and communications staff rather than on the IT team that would normally own an incident. That changes who is making decisions under stress at your organization, and it usually happens before your forensics work has established what was actually taken.

The named victims in Health-ISAC's alert show the breadth of the target set. Medtronic and iRhythm are medical device manufacturers, while OneMedical, DentaQuest, AdaptHealth, and Him & Hers span primary care, dental benefits, home medical equipment, and telehealth. If you sit anywhere in that range, your data profile is close enough to be relevant.

Regulatory exposure begins the moment you determine PHI was accessed or acquired. If you treat or employ people in the EU, GDPR obligations apply in parallel with their own reporting expectations and supervisory authority scrutiny.

Notification itself is a substantial cost line before any penalty is assessed. You are paying for forensic review to scope the affected population, mailing and call center capacity, credit monitoring offers, outside counsel, and regulator correspondence that can run long after the technical incident closes. Class action filings in healthcare data theft cases now routinely follow the public notification, meaning your disclosure is what starts the litigation clock.

Operational disruption is real even without encryption. Suspending compromised accounts, revoking sessions, and restricting SaaS access during containment interrupts scheduling, billing, and clinical documentation workflows that depend on those same platforms.

Supply chain exposure deserves separate attention in your risk register. When a SaaS vendor or business associate holding your data is compromised, the reporting obligation still flows to you as the covered entity, and you will be explaining an incident that occurred in a system you do not administer. Your business associate agreements determine how quickly you learn about it, which directly affects whether you can meet your own notification deadlines.

Detecting Unauthorised SaaS Access and Bulk Data Exports

Detection for this campaign lives in identity and SaaS audit logs, not on the endpoint. ShinyHunters authenticates with valid credentials on a device the helpdesk enrolled, so EDR telemetry sees a normal browser session against a normal cloud service. The signal sits in the sequence of identity events and in the volume of data leaving the tenant.

The first cluster of evidence is the account recovery itself. In Entra ID audit logs and Okta system logs, the reset chain shows up as a password change, an MFA factor registration or deletion, and a device registration event, all tied to one user within a short window and often initiated by a helpdesk operator account. Mapped to MITRE ATT&CK, that is T1556.006 (Modify Authentication Process: Multi-Factor Authentication) followed by T1098.005 (Account Manipulation: Device Registration). Reset activity landing outside the helpdesk's staffed hours, or clustering against multiple users who share a department, is the pattern Health-ISAC describes when the group vishes several employees before one call succeeds.

Sign-in telemetry carries the second cluster. Correlating the successful authentication that follows a reset against the user's baseline usually exposes a different autonomous system number, commercial VPN or hosting-provider address space, and a user agent that does not match the enrolled corporate build. Health-ISAC specifically calls out geo-velocity and impossible travel checks, which fire when the reset call and the subsequent login originate from locations that cannot be reconciled in the elapsed time. Repeated MFA prompts against a single account before approval, ATT&CK T1621, indicate push bombing rather than a genuine user retry.

Once inside, the activity worth alerting on is application enumeration and bulk retrieval. The audit surfaces that matter across the platforms named in the alert include:

• New OAuth application registrations and unusual consent grants in Entra ID or Okta, which give the attacker token-based access that survives a password change (ATT&CK T1550.001, Application Access Token)
• Salesforce Event Monitoring records for report exports, Data Loader sessions, and Bulk API job creation by an account with no prior export history
• Microsoft 365 and SharePoint unified audit log entries showing site collection crawls, large file sync initiation, or repeated downloads from document libraries the account rarely touches
• Google Drive and Dropbox audit events for mass downloads, sharing-link creation, or ownership transfers
• CASB or cloud app telemetry showing API call volume from one session that departs sharply from the account's normal rate

Health-ISAC also flags new forwarding rules and mailbox delegation changes (ATT&CK T1114.003). Those are persistence and collection mechanisms that keep working after the session ends, and they are cheap to alert on because legitimate users create them rarely.

Useful alert logic joins these layers instead of treating them separately. A rule that fires when an MFA or device registration event is followed within a defined window by a sign-in from an unfamiliar ASN and then by an export or bulk download event produces far fewer false positives than any of the three conditions alone. Adlumin's SIEM and ITDR coverage in managed environments correlates Entra sign-in and audit streams with SaaS activity for exactly this kind of chained condition, which matters because the exfiltration window here is measured in the length of a single session.

Detection content is only as good as the log sources feeding it. If your Salesforce org does not have Event Monitoring enabled, or SaaS audit logs stop at the platform rather than reaching your SIEM, the export step generates no alert at all and the first notification of the theft is the extortion message.

Immediate Steps for Healthcare Security Teams

The first fix is procedural, and you can put it in place this week: no password reset, MFA reset, or device re-enrollment is ever completed on the same inbound call. The agent closes the call and calls back on a number already on file, and any privileged account needs manager approval on top of that. Health-ISAC identifies this single control as the most important one available, because it breaks the link between the vishing call and the SSO account takeover.

Brief your help desk and IAM support staff on the exact wording of that procedure, and give them explicit permission to refuse an urgent-sounding request. Callers pressure agents by invoking executives, patient care delays, or a shift starting in ten minutes. An agent who knows the callback rule is mandatory has something to point at other than their own judgment.

Inside the same few days, work through the SaaS tenant itself:

• Audit connected apps and OAuth tokens across Microsoft 365, Salesforce, and Google Workspace, and revoke consent for any integration without a named business owner. Tokens granted months ago keep working long after a password changes.
• Restrict bulk export capability to named roles. Data Loader, bulk API access, and mass download rights should sit with a small list of identified people, not with every account that happens to hold an admin label.
• Apply IP allowlisting to SaaS administrative accounts so console access only works from your office ranges or corporate VPN egress.
• Inventory who holds Tier 0 access to the identity platform itself and remove standing privilege that nobody has used this quarter.

Over the next few weeks, move administrators and high-risk groups onto phishing-resistant MFA using FIDO2 or WebAuthn security keys, then extend it to the rest of the workforce. Disable SMS and voice MFA as fallback methods, or restrict them tightly, and put strict controls around who can register a new MFA factor. A hardware key cannot be reset by a persuasive phone call the way a push notification can.

Tighten session lifetimes on cloud administrative portals at the same time. Long-lived sessions extend the window during which a stolen token remains useful, and shorter timeouts force reauthentication against the key. Pair that with blocking legacy authentication protocols, requiring compliant managed devices for administrative portals, and enabling geo-velocity and impossible travel checks. Then review third-party vendor access: billing services, transcription vendors, and analytics partners often hold federated access into the same tenant.

In environments Capstone manages, Adlumin correlates authentication behaviour across identity providers and flags the reset-then-new-device-then-bulk-access sequence that precedes exfiltration, which matters when the login itself is technically valid.

For the longer horizon, stand up SaaS security posture management so that consent grants, external sharing settings, and permission drift get reviewed on a schedule instead of during an incident. Run tabletop exercises specifically for containing a compromised cloud account, walking through token and session revocation, because revoking sessions is a different muscle from isolating an endpoint. Include vishing scenarios in those exercises and in awareness training, with simulations aimed at privileged users, help desk staff, new hires, and remote workers.

Have your breach notification playbook drafted and approved by legal and compliance before you need it, including HIPAA notification timelines and the decision points for engaging counsel. Health-ISAC sets a 30 to 60 day window for this programme, starting with phishing-resistant MFA for high-risk users, hardened help desk reset procedures, and conditional access enforcement.

Priorities for Healthcare and Life Sciences Organisations

The organisations named in Health-ISAC's alert cover more of the health sector than hospitals alone. Medtronic and iRhythm are medical device manufacturers, and OneMedical, DentaQuest, AdaptHealth, and Him & Hers span primary care, dental benefits administration, home medical equipment, and telehealth. If your organisation handles health data in any of those roles, you sit in the same target set as the providers.

The shift worth absorbing is where your data now lives and how it leaves. Healthcare breach planning has been built around endpoint compromise and clinical system downtime. In this campaign, no malware runs in your environment, no server is exploited, and your identity provider plus the SaaS applications behind it become the surface that matters.

That reframes something most organisations treat as a service function. Your help desk's identity verification script is a security control with the same weight as an access rule on your firewall, and it is owned by a team usually measured on how quickly calls are resolved. Health-ISAC's own guidance treats single sign-on as a Tier 0 asset, which puts the people who reset access to it in the same category.

The single most important piece of work is knowing which connected applications, service accounts, and administrative roles across your cloud estate hold bulk export rights, restricting those permissions to named owners, and holding every password, MFA, and device change to out-of-band verification. Those two items are what stand between a vishing call and a full tenant export.

Health-ISAC frames this as work to complete in weeks. Start with the accounts and applications that can pull data at scale.