The latest wave of breaches attributed to the ShinyHunters cybercrime collective (e.g., University of Nottingham, DentaQuest, 7-Eleven, Medtronic, and Wynn Resorts), reinforces a hard truth security leaders can no longer ignore: attackers are increasingly bypassing traditional perimeter defenses and targeting identities, authentication workflows, SaaS integrations, and trusted access paths instead of exploiting software vulnerabilities directly.
Over the past several months, ShinyHunters has been linked to attacks involving Salesforce environments, Snowflake customers, SaaS integrations, and identity platforms such as Okta. Researchers and incident responders have consistently observed the same pattern: stolen credentials, compromised OAuth tokens, social engineering, vishing, and abuse of legitimate access privileges.
This is not merely another breach trend. It is evidence that identity has become the primary battleground in enterprise security.
The Evolution of the ShinyHunters Playbook
Historically, attackers focused on exploiting unpatched systems or deploying malware to gain persistence. Today’s identity-centric threat actors operate differently. Instead of “breaking in,” they log in.
