Loading story…
A breach at a third-party SaaS integration provider allegedly exposed authentication tokens that were then used to steal data from more than a dozen companies, with most of the activity targeting Snowflake customer environments. Snowflake said it detected unusual activity affecting a small number of customers tied to a specific third-party integration and emphasized that its own platform was not compromised through a vulnerability. Reporting identified the suspected source as Anodot, a data anomaly detection company owned by Glassbox, though neither company publicly responded at the time.
The threat actor identified as ShinyHunters claimed responsibility, saying it stole data from dozens of organizations and sought extortion payments to prevent publication of the information. The campaign reportedly also targeted other cloud and SaaS providers, while an attempted theft involving Salesforce was said to have been blocked by AI-based detection. Google Threat Intelligence Group said it was tracking the incident, and Payoneer said it was aware of the provider breach linked to Anodot but had determined it was not affected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Vimeo disclosed that attackers accessed some customer and user data as a downstream result of the Anodot breach, including technical data, video titles, metadata, and in some cases email addresses. The company said uploaded video content, credentials, and payment card data were not affected, and it disabled Anodot credentials, removed the integration, and notified law enforcement.
Rockstar Games was named as one of the companies affected by the Anodot-linked token theft campaign. The company said attackers accessed only a limited amount of non-material company information.
As part of its response to the Anodot-linked intrusion activity, Snowflake said it locked potentially impacted customer accounts and notified affected customers. The company reiterated that its own systems were not compromised and no software vulnerability was exploited.
Google Threat Intelligence Group said it was aware of and tracking the incident. Payoneer also acknowledged awareness of the Anodot-related provider breach and said it determined it was not affected.
The ShinyHunters threat actor claimed responsibility for the attacks, saying it stole data from dozens of companies and demanded ransom payments to prevent publication. The campaign was described as an extortion operation following the token theft.
The threat actor said it also attempted to steal data from Salesforce, but the effort was blocked by AI-based detection systems. This was reported as part of the broader token-enabled intrusion campaign.
Snowflake said it detected unusual activity affecting a small number of customers linked to a specific third-party integration. The company stated its own systems were not compromised and no Snowflake vulnerability was involved.
Using the stolen tokens, attackers conducted data theft attacks against more than a dozen companies across cloud and SaaS environments. Most of the observed activity targeted Snowflake customer accounts.
A security issue at SaaS integration provider Anodot allegedly led to the theft of authentication tokens later used to access customer environments. Anodot and parent company Glassbox had not responded publicly at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcetechcrunch.com
Open sourcescworld.com
Open sourcetechradar.com
Open sourcebleepingcomputer.com
Open sourcethreats.wiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A broad intrusion campaign compromised **Snowflake customer environments** including Ticketmaster, Santander and AT&T after attackers used credentials stolen by infostealer malware or bought on criminal forums, rather than exploiting a flaw in Snowflake itself. Reporting tied the activity to **ShinyHunters**, which advertised allegedly stolen data from Ticketmaster and Santander, while Mandiant said many affected accounts lacked **multifactor authentication** and that more than 100 customer environments were targeted. AT&T said the attackers accessed its Snowflake environment in April and stole call and text metadata for nearly **110 million** customers, including numbers contacted, interaction counts and aggregate call durations, but not message content. The campaign evolved from data theft into **extortion**, with victims receiving ransom demands and law enforcement pursuing suspects tied to the operation. Canadian authorities arrested a man from Kitchener, Ontario, in connection with the Snowflake hacking and extortion scheme, and reporting later indicated another suspected participant may have been a U.S. soldier. Government agencies including Australia’s Signals Directorate and U.S. investigators were drawn into the response, and AT&T said disclosure of its breach was temporarily delayed at the request of the FBI and DOJ because of national security and public safety concerns.
Jun 29, 2026
**ShinyHunters** has been linked to a wave of SaaS-focused data-theft and extortion activity enabled by targeted **voice phishing (vishing)** and company-branded phishing portals designed to capture **SSO credentials** and **MFA codes**. Mandiant reported that attackers impersonate IT/helpdesk staff, direct employees to realistic login pages, and use real-time interaction (including guiding victims to approve push prompts or provide one-time codes) to authenticate and then **enroll attacker-controlled devices into MFA**. After account takeover, the actor pivots through **Okta, Microsoft Entra, or Google** SSO dashboards to rapidly access downstream SaaS services (e.g., *Salesforce*, *Microsoft 365/SharePoint*, *DocuSign*, *Slack*, *Atlassian*, *Dropbox*, *Google Drive*), turning a single compromised identity into broad cloud data access. Separately, **Bumble** reported a phishing-driven compromise of a **contractor account**, after which ShinyHunters allegedly claimed theft of ~**30 GB** of data—reported as largely internal files sourced from **Google Drive** and **Slack**—while Bumble stated there was no evidence of exposure of user chats or profiles. Reporting also tied ShinyHunters to other claimed or alleged thefts affecting consumer and enterprise brands (including Match Group properties such as *Hinge*, *Match*, and *OkCupid*), consistent with the broader pattern of leveraging compromised identities and SaaS access paths for data exfiltration and extortion leverage.
Jun 29, 2026
Attackers breached market intelligence vendor **Klue** and used a compromised legacy credential tied to an old integration service to implant malicious code, harvest customer OAuth tokens, and access connected **Salesforce** environments through the `Klue Battlecards` app. Incident responders and affected companies said the attackers then used legitimate Salesforce REST API access to enumerate objects and exfiltrate CRM data over many hours, including business contacts, account records, quotes, sales communications, support case metadata, and related commercial information. **Salesforce** disabled the Klue app connection during the investigation and stressed the incident did not result from a vulnerability in the Salesforce platform itself, while Klue revoked credentials and tokens, disabled multiple integrations, engaged CrowdStrike, and notified law enforcement. The campaign has been widely attributed to the **Icarus** extortion group, which allegedly sent ransom demands and threatened to leak stolen data, though some reporting noted tradecraft overlaps with **ShinyHunters**-style Salesforce OAuth abuse. Publicly disclosed victims grew from early reports involving **Huntress**, **Recorded Future**, **Jamf**, **Tanium**, **Sprout Social**, **Gong**, **HackerOne**, **Snyk**, **OneTrust**, and **Insurity** to later confirmations from **LastPass**, **BeyondTrust**, and others, with some reports putting the total affected customer count far higher. Most impacted organizations said the exposure was largely confined to CRM and business data in Salesforce or connected apps, with no evidence that core products, internal infrastructure, password vaults, payment data, or engineering systems were compromised.
Aug 11, 2026