ShinyHunters Breaches Brinks Home via Voice Phishing, Exposing 4.9M Records
ShinyHunters gained initial access to Brinks Home's systems through a voice phishing (vishing) attack targeting Microsoft Entra credentials, demonstrating that even security-focused companies are vulnerable to social engineering. The seven-day gap between compromise (July 13) and discovery (July 20) allowed the attackers ample time to exfiltrate millions of Salesforce records containing sensitive customer PII and chat logs. This breach highlights the critical importance of phishing-resistant multi-factor authentication (MFA) and robust employee training specifically around telephone-based social engineering tactics. The scale of the data stolen — nearly 5 million customer records — creates lasting fraud and identity theft risks for affected individuals, amplifying the regulatory and reputational consequences for Brinks Home.
Tactical Insight
Immediate actions
- Replace SMS/voice-based MFA with phishing-resistant alternatives such as FIDO2 hardware security keys or certificate-based authentication for all Microsoft Entra accounts.
- Audit and restrict which roles have access to bulk Salesforce data exports or API queries to limit blast radius from compromised credentials.
- Issue customer advisories warning of increased fraud, impersonation, and phishing attempts using their stolen PII.
Long-term improvements
- Implement a formal vishing/social engineering awareness training program with simulated voice phishing exercises for all employees, especially those with privileged access.
- Apply zero-trust principles by enforcing continuous identity verification and least-privilege access controls across CRM and cloud platforms.
- Establish data minimization and retention policies in Salesforce to reduce the volume of sensitive records available to any single account or API integration.
Detection measures
- Deploy user and entity behavior analytics (UEBA) to alert on anomalous bulk data access or exports from Salesforce and other data repositories.
- Configure Microsoft Entra Identity Protection to flag and block risky sign-ins, including logins from unfamiliar locations or after suspicious MFA prompts.
- Set a maximum acceptable detection window (e.g., 24–48 hours) for credential compromise events and test against it regularly through purple team exercises.