Notifications
Clear all
Topic starter
14/07/2026 6:07 pm
TL;DR: Google’s Salesforce hack and the wider ShinyHunters-Scattered Spider campaign show how social engineering, trust abuse, and rapid exfiltration can turn routine SaaS access into a data-breach path, according to Swarmnetics. The pattern underscores that MFA, privilege distribution, and offboarding discipline must be treated as connected controls, not separate checkboxes.
NHIMG editorial — based on content published by Swarmnetics covering the Google Salesforce hack and the ShinyHunters campaign: Google Reports Salesforce Hack, ShinyHunters Plans to Launch Data Breach Site August 14, 2025
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.
Questions worth separating out
Q: What fails when attackers use help desk social engineering to get into SaaS environments?
A: The failure is usually not the password or token alone.
Q: Why do SaaS identities create such a large attack surface after a breach?
A: SaaS identities are powerful because a valid session can unlock email, storage, delegated apps, and admin changes without needing new exploits.
Q: What do teams get wrong about phishing-resistant MFA?
A: They often measure success by the presence of a strong factor instead of the absence of weaker bypasses.
Practitioner guidance
- Harden help desk recovery workflows Require high-assurance identity proofing before password resets, MFA re-enrolment, or access restoration, especially for admin and support accounts.
- Reduce SaaS privilege fan-out Inventory which users, service accounts, and integrations can pivot from a Salesforce-like tenant into other systems, then remove broad delegated access and unused admin relationships.
- Treat phishing-resistant MFA as one layer Keep phishing-resistant MFA in place, but pair it with restrictions on recovery channels, token re-issuance, and delegated approvals so attackers cannot bypass strong authentication through softer workflows.
What's in the full analysis
Swarmnetics' full analysis covers the operational detail this post intentionally leaves for the source:
- The article breaks down the reported split between social-engineering entry and post-compromise exfiltration.
- It expands on the Google Salesforce hack context and what was disclosed about the data involved.
- It discusses the alleged merger or collaboration between ShinyHunters and Scattered Spider and why that changes the threat picture.
- It outlines why the planned leak site increases extortion pressure on victims.
👉 Read Swarmnetics' analysis of the Google Salesforce hack and ShinyHunters campaign →
Google Salesforce hack and ShinyHunters: what IAM teams should watch?
Explore further
14/07/2026 6:11 pm
Identity trust collapse is the real breach, not the Salesforce tenant itself. The article describes a pattern where support workflows, phishing-resistant authentication gaps, and overextended SaaS privileges combine into one compromise path. That means the failure is not just access control, but the assumption that authenticated identity still implies trustworthy intent. Practitioners should treat the trust chain as the asset under attack.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, including 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when stolen identities are used to exfiltrate data through SaaS?
A: Accountability usually spans IAM, cloud platform owners, and data governance teams because the abuse crosses authentication, authorization, and information handling boundaries. Organisations should assign clear ownership for delegated access, token lifecycle, and privileged cloud activity so the same gap is not left between three different teams.
👉 Read our full editorial: Google Salesforce hack shows how NHI trust breaks in breaches
