One Compromised Identity Opens SaaS Data Everywhere
A single stolen login or trusted integration can give ShinyHunters a wide cloud foothold without breaking Salesforce or Snowflake directly. The weak point is the trust chain around SSO, helpdesk resets, and OAuth grants, which can let one approved identity reach multiple SaaS systems at once.
Health-ISAC says it is seeing more successful attacks against healthcare and medtech, with ShinyHunters leaning on third-party integrations and identity abuse. The group has used vishing and phishing to compromise corporate SSO accounts, then moved through dashboards tied to Salesforce, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and other connected services.
For healthcare, the blast radius is broader than a single mailbox or app. A compromised account or app connection can expose customer data across the SaaS stack, and patching one service does not remove access already granted through another trusted identity.