Boston Scientific and McKesson disclosed separate cyber incidents impacting healthcare operations and sensitive data. Boston Scientific’s ongoing attack disrupted remote monitoring for some implanted cardiac devices, while McKesson confirmed unauthorized access to third-party apps tied to specific business units after ShinyHunters claimed it stole large volumes of patient data by voice-phishing employees.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ShinyHunters claims they stole 284 million patient records after voice‑phishing McKesson staff. The call sounds legit: “Hi, this is support for your Snowflake or Salesforce environment. We’re seeing suspicious access and need to verify your account to prevent an outage.” Then they walk you into sharing MFA codes or approving prompts. That’s how they say they got into McKesson’s Snowflake and Salesforce, then exfiltrated data tied to specific business units. One pressured phone call, and suddenly patient PII and health info are flowing out the door. If you get an unexpected Snowflake or Salesforce support call, hang up and call back using our official help desk or vendor contacts. If they’re real, they’ll be there.
This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing…
McKesson disclosed a breach tied to unauthorized access of third-party applications and data theft affecting some customers. The ShinyHunters extortion group claims it used phone-based social engineering (vishing) to steal employee credentials, took over Okta single sign-on accounts, and then…
McKesson confirmed a cyber incident after the ShinyHunters extortion group claimed it stole roughly 284 million patient-related records. The attacker claims the initial access came from phone-based social engineering (vishing) against employees to compromise Okta single sign-on accounts, then pivot…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
Brinks Home says it is investigating a cybersecurity incident after the ShinyHunters group claimed it broke in by calling employees and tricking them into approving Microsoft Entra authentication actions. The attacker is threatening to publish data it claims to have stolen, including alleged…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
