ReliaQuest confirms failed data-theft attack after ShinyHunters breach

A ReliaQuest employee was socially engineered by the ShinyHunters gang, who impersonated internal security staff to steal credentials and MFA approvals through a convincing fake SSO portal. This attack highlights how even security-focused organizations are vulnerable to credential phishing when employees cannot distinguish legitimate login pages from spoofed ones. The incident demonstrates that MFA alone is insufficient if users can be manipulated into approving fraudulent authentication requests — a technique known as MFA fatigue or real-time phishing proxying. Fortunately, defense-in-depth controls limited the blast radius, preventing access to sensitive applications or customer data. This serves as a critical reminder that human factors remain the most exploitable attack surface regardless of technical sophistication.