Health-ISAC warns of exfiltration-first extortion in healthcare

Health-ISAC warned members about ShinyHunters campaigns that use voice phishing and MFA bypass to seize Okta, then exfiltrate data from Salesforce and Snowflake. One case involved over 1 TB and more than 200 million records, with a $55 million demand. No file encryption was used.

• Attack starts with voice phishing and a fake SSO page to steal credentials and a one-time code
• Operators enroll their own device as a second factor and take over the Okta identity platform
• More than 1 TB of data and over 200 million records were exported from Salesforce and Snowflake
• The $55 million demand involves no encryption: only revocation and rotation can remediate it