Salesforce, Google, Okta, Louis Vuitton, Allianz, Odido: all breached under the same name. Shiny Hunters may not even be one group. It is a brand that different criminal crews borrow to extort their victims, because the reputation does half the work.
The uncomfortable part is how simple it is. No fancy malware, no zero-days. Almost every documented breach started with a phishing call to the help desk, over-permissive credentials, and data copied straight out of a SaaS platform. Host Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Field CTO Rob Maas and ON2IT researcher Yuri Witt to trace how these attacks land, why the attacker's name never matters to your defense, and the basic controls that stop them: multi-factor authentication, IP access control on your SaaS tenants, no over-permissive accounts, and deleting the toxic data you no longer need.
If you run SaaS at scale, treat this as a checklist for the controls most teams still have not switched on.
Charpters:
00:00:00 One name behind a dozen mega-breaches
00:01:06 Shiny Hunters: a group, or a brand?
00:04:16 The leak site: extortion as a marketplace
00:05:37 How they get in: phishing the help desk
00:07:54 Basic defenses: MFA, no admin rights, block downloads
00:09:36 Pay up or we leak: the Odido case
00:11:24 Lock down SaaS, delete toxic data, and Zero Trust
