Latest / Tech Talks With Kinsoft / ADT – ShinyHunters Vishing Breach Hits 5.5M

Transcript

ADT – ShinyHunters Vishing Breach Hits 5.5M · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. You know,
• 0:02
  ADT's entire brand is basically built on securing
• 0:05
  perimbers, right? Oh, absolutely. They're the
• 0:07
  ones you pay to lock down your physical house.
• 0:09
  Exactly. You put their sensors on every window,
• 0:11
  you have them monitor the alarms, all of that.
• 0:13
  But last month, attackers walked away with the
• 0:17
  personal data of 5 .5 million ADT customers.
• 0:21
  Which is just a staggering number. It really
• 0:24
  is. And the craziest part is that those attackers
• 0:26
  didn't have to break a single digital lock or
• 0:29
  burn some advanced zero -day exploit or even
• 0:32
  breach a firewall to do it. They literally just
• 0:34
  picked up the phone. Yeah, it's wild. So our
• 0:37
  mission today is to unpack this massive April
• 0:39
  2026 data breach. We're relying on a really detailed
• 0:44
  security report from the ISMG Network's Bank
• 0:46
  Info Security, written by Matthew J. Schwartz.
• 0:49
  And we're looking at... Well, really, this cascading
• 0:52
  failure of centralized login systems and the
• 0:54
  inherent risks of human trust. Right, because
• 0:56
  this report is, honestly, it's a sobering look
• 0:59
  at modern attack chains. We're seeing a complete
• 1:01
  shift in the threat landscape. Well, the most
• 1:03
  sophisticated technical perimeters are just being
• 1:06
  bypassed entirely. The attackers aren't hacking
• 1:09
  the technology anymore. They're hacking the people
• 1:12
  operating the technology, which basically turns
• 1:15
  these massive, you know, multi -million dollar
• 1:18
  investments in corporate security completely
• 1:20
  inside out. So if we trace the timeline back
• 1:23
  before we get into the how, let's look at what
• 1:26
  actually happened. According to ADT's SEC filings,
• 1:30
  they first detected unauthorized access to their
• 1:33
  cloud environments around April 20th, 2026. Yeah,
• 1:37
  that was the initial detection. And then within
• 1:39
  just four days, this internal crisis totally
• 1:42
  exploded into public view. On April 24th, this
• 1:45
  extortion group known as Shiny Hunters listed
• 1:47
  ADT on their dark web leak site. Which is never
• 1:50
  where you want to see your company's name. Definitely
• 1:52
  not. And they stamped this really rigid pay or
• 1:55
  leak deadline on the data. Now, shiny hunters,
• 1:57
  they immediately claimed they had stolen over
• 2:00
  10 million customer records. Right. But there's
• 2:02
  always a discrepancy there, you know, between
• 2:04
  what an extortion group claims, mostly for marketing
• 2:06
  purposes, and the actual reality of the blast
• 2:09
  radius. Right. So what was the actual damage?
• 2:11
  Well, when breach tracking services like Have
• 2:14
  I Been Pround, when they analyzed the actual
• 2:16
  dump, the confirmed number settled at 5 .5 million
• 2:21
  unique. customer email addresses okay so about
• 2:24
  half of what they claimed exactly but alongside
• 2:27
  those emails shiny hunters exfiltrated names
• 2:29
  physical home addresses and phone numbers and
• 2:33
  in a smaller percentage of cases the data actually
• 2:35
  included dates of birth and the last four digits
• 2:38
  of social security number or tax IDs oh wow But
• 2:42
  I guess that leaves a lot of extremely sensitive
• 2:44
  data untouched, right? Because the report explicitly
• 2:47
  confirms that the actual physical home security
• 2:49
  systems, like the alarm panels and cameras inside
• 2:53
  people's houses, those were completely uncompromised.
• 2:56
  Yeah, that's a crucial point. The physical hardware
• 2:58
  was safe. payment card data was also safe, the
• 3:01
  breach was strictly contained to the customer
• 3:02
  CRM records. OK, but looking at that 5 .5 million
• 3:06
  number, have I been proud noted that 71 % of
• 3:09
  those exposed email addresses were actually already
• 3:11
  floating around in their database from previous
• 3:14
  totally unrelated breaches? Yeah, that's pretty
• 3:16
  common these days. Right. So let me push back
• 3:18
  here for a second. If the vast majority of these
• 3:21
  customers already have their basic information
• 3:23
  circulating on the dark web, does a breach like
• 3:27
  this actually you know, move the needle on their
• 3:30
  personal risk. Oh, it radically shifts their
• 3:33
  threat model. Wait, really? How? Because of a
• 3:35
  concept called contextual clustering. See, threat
• 3:39
  actors don't just view a stolen email address
• 3:41
  in isolation. When they acquire a database, they
• 3:44
  run automated scripts to cross -reference it
• 3:46
  with massive pre -existing troves of leaked data.
• 3:49
  Oh, I see. So an attacker might have had your
• 3:52
  email from like a low -spakes forum breach five
• 3:55
  years ago, but now, now they can connect. that
• 3:58
  email to the verified fact that you own a home,
• 4:01
  that you possess the disposable income to afford
• 4:04
  a premium ADT security tier. And most importantly,
• 4:08
  they have your current physical street address.
• 4:10
  That immediately weaponizes the data. It transforms
• 4:12
  like a generic mass spam campaign into a highly
• 4:15
  targeted spear phishing attack instead of a spray
• 4:18
  and pray email pretending to be PayPal. The attacker
• 4:21
  can send an SMS message saying, you know, ADT
• 4:24
  alert. Your panel at this specific street address
• 4:27
  is offline. Click here to authenticate. And the
• 4:31
  success rate of that kind of social engineering
• 4:33
  just skyrockets when the attacker wields that
• 4:36
  level of specific commercial context. They're
• 4:39
  manipulating the established trust between you,
• 4:42
  the customer, and the vendor. Right. And understanding
• 4:44
  that manipulation of trust is actually the key
• 4:47
  to understanding how Shiny Hunters breached ADT
• 4:49
  in the first place. Because ADT's external security
• 4:52
  perimeter is incredibly tight. So to get that
• 4:55
  data, Shiny Hunters didn't brute force a server.
• 4:58
  They executed a vishing campaign. campaign, right?
• 5:01
  Voice phishing. Voice phishing. They called an
• 5:02
  ADT employee, impersonated IT support, and basically
• 5:06
  just asked for access. To me, it's akin to a
• 5:08
  digital vampire. A vampire. Yeah. Like no matter
• 5:11
  how strong your digital locks are, the attacker
• 5:13
  cannot get in unless an employee actively invites
• 5:16
  them over the threshold by handing them the keys.
• 5:19
  That is a great way to put it. And shiny hunters,
• 5:21
  they actually emerged from this Western English
• 5:24
  speaking cybercrime community known as the comm.
• 5:27
  Oh, right. I've heard of them. Yeah. And they
• 5:29
  specialize in this exact social engineering playbook.
• 5:32
  It's really crucial to understand that they aren't
• 5:34
  just improvising on these calls. They use very
• 5:37
  sophisticated phishing as a service tool kits.
• 5:40
  So what does that look like behind the scenes?
• 5:42
  Well, the attacker is looking at a real time
• 5:43
  dashboard. When they call the employee and direct
• 5:46
  them to a fake login portal, that portal is actually
• 5:49
  acting as an adversary in the middle proxy. So
• 5:53
  even if the employee is using MFA like getting
• 5:56
  a push notification or a code on their phone.
• 5:59
  The toolkit just handles it. Exactly. The employee
• 6:02
  types the code into the fake site. The proxy
• 6:04
  intercepts the session cookie in real time. And
• 6:07
  the attacker uses that cookie to seamlessly log
• 6:10
  into the real system. The MFA is rendered entirely
• 6:13
  useless. Because the human is totally convinced
• 6:15
  they're talking to legitimate IT support. Corporations
• 6:20
  spend millions on security awareness training.
• 6:23
  Every employee takes those mandatory quizzes
• 6:26
  on spotting phishing and securing their credentials.
• 6:30
  So why does the IT help desk remain such a massive
• 6:33
  vulnerability to these vishing tactics? It really
• 6:36
  comes down to the fundamental psychology and
• 6:38
  the actual mandate of an IT help desk. What do
• 6:41
  you mean? Well, think about it. The entire performance
• 6:44
  metric for a support employee is based on time
• 6:47
  to resolution and helpfulness. Their professional
• 6:50
  identity is tied to reducing friction for their
• 6:53
  colleagues. That makes sense. They want to fix
• 6:55
  things fast. Right. So when an attacker calls
• 6:57
  in sounding super professional, professional
• 6:59
  but panicked, claiming they're, I don't know,
• 7:01
  an executive locked out of a critical system
• 7:03
  10 minutes before a board meeting, the help desk
• 7:06
  worker's immediate instinct is to solve the problem.
• 7:08
  Ah, so the attacker is weaponizing the employee's
• 7:11
  desire to just do a good job. Because security
• 7:14
  protocols, by their very nature, they introduce
• 7:17
  friction, right? Absolutely do. They demand verification,
• 7:20
  secondary checks, delays, and the attacker's
• 7:23
  goal is to convince the employee that bypassing
• 7:26
  that friction is not just acceptable, but urgently
• 7:30
  necessary for the company. Yeah, and it's nearly
• 7:32
  impossible to train out human empathy. You're
• 7:35
  basically asking a help desk worker to treat
• 7:37
  every panicked colleague as a potential hostile
• 7:40
  threat. Shiny Hunters exploits that cognitive
• 7:43
  dissonance perfectly. And once they bypass that
• 7:46
  human layer and capture the credentials, the
• 7:48
  architectural setup of the company basically
• 7:50
  does the rest of the work for them. Right. Let's
• 7:53
  talk about that architecture. Because the employee
• 7:55
  handed over their Okta credentials. And Okta,
• 7:57
  for those who don't know, it acts as the single
• 8:00
  sign -on or... SSO for the enterprise. Like Microsoft
• 8:02
  Entra or Google Workspace. Exactly. It's like
• 8:05
  the master key to the corporate building. It's
• 8:07
  brilliantly convenient. Employees log in once
• 8:09
  and they get access to their email, internal
• 8:12
  wikis, HR portals, everything. But that convenience
• 8:15
  has a massive downside. Right, because once shiny
• 8:18
  hunters compromised that single Okta session,
• 8:20
  they didn't just get into the lobby. The blast
• 8:22
  radius was massive. They pivoted directly from
• 8:25
  Okta into ADT's Salesforce environment. Yeah,
• 8:28
  and Salesforce is the VIP lounge in this scenario.
• 8:31
  It's the CRM where all the incredibly rich, enriched
• 8:34
  customer data resides. And this pivot from SSO
• 8:38
  to CRM is actually the signature move for shiny
• 8:40
  hunters. Really? That specific jump? Yes. They
• 8:43
  don't want to spend... weeks moving laterally
• 8:46
  through obscure legacy servers or trying to crack
• 8:48
  encrypted databases. They target the identity
• 8:51
  provider specifically to reach the CRM. But I
• 8:54
  want to clarify something here. They aren't exploiting
• 8:56
  a flaw in Salesforce's underlying code. Right.
• 8:59
  Salesforce itself isn't being hacked in the traditional
• 9:02
  sense. Correct. They are simply utilizing the
• 9:04
  legitimate access they just stole. The Okta integration
• 9:07
  means the attacker inherits whatever permissions
• 9:09
  the compromised employee had. Oh, I see. Furthermore,
• 9:12
  once inside the Salesforce environment, attackers
• 9:14
  look for misconfigured API integrations or overly
• 9:18
  permissive oath tokens. Like third -party marketing
• 9:20
  tools. Exactly. Many companies integrate analytics
• 9:23
  tools into their CRM. And if those connections
• 9:26
  aren't heavily restricted, an attack... Hacker
• 9:28
  can use them to siphon out those 5 .5 million
• 9:31
  records quietly and efficiently. And this playbook
• 9:34
  is highly scalable, isn't it? Yeah. The Bank
• 9:36
  Info Security Report points out that Shiny Hunters
• 9:38
  has used this exact SSO to Salesforce pipeline
• 9:41
  since the beginning of the year to compromise
• 9:44
  heavyweights like Harvard, the University of
• 9:46
  Pennsylvania. Match Group, various investment
• 9:48
  advisory firms. Yeah, they have essentially industrialized
• 9:52
  the process of turning a single vishing call
• 9:55
  into a massive data exfiltration. event. Because
• 9:58
  the underlying architecture of modern enterprise
• 10:00
  IT practically demands it. I mean, centralization
• 10:04
  equals efficiency, but it also creates this single
• 10:06
  point of catastrophic failure. That's the trade
• 10:09
  -off. When you aggregate all access into one
• 10:11
  identity provider and all customer data into
• 10:14
  one CRM, you are building a tremendously lucrative
• 10:17
  target for threat actors. They literally only
• 10:19
  need to trick one person to get the keys to the
• 10:22
  kingdom. Which brings us to the extortion phase.
• 10:24
  The fortress is bypassed, the Salesforce data
• 10:27
  is copied to the attacker's servers, and shiny
• 10:29
  hunters post their pay or leak ultimatum. on
• 10:32
  April 24th. Right. The pressure is on. For a
• 10:35
  company staring down that barrel, the incident
• 10:37
  response playbook comes into sharp focus. Now,
• 10:40
  the report cites Unit 221B, which is a threat
• 10:44
  intelligence firm that closely monitors these
• 10:46
  syndicates. And their mandate to victims is to
• 10:49
  absolutely never pay the ransom and to entirely
• 10:52
  refuse opening any channel of communication.
• 10:55
  Yeah, and Unit 221B's guidance is rooted in the
• 10:58
  operational mechanics of extortion groups. Why
• 11:01
  is even talking to them a bad idea? Because in
• 11:03
  gaving with the attackers, even just to stall
• 11:05
  for time or verify the data, it acts as a signal.
• 11:08
  It tells the threat actors that the victim organization
• 11:11
  values the stolen data and is in a state of panic.
• 11:14
  It qualifies the company as a viable mark. Exactly.
• 11:17
  And with a volatile group like shiny hunters
• 11:19
  showing any indication that you might pay triggers
• 11:21
  an immediate escalation into harassment attacks.
• 11:24
  And the harassment phase is where this evolves
• 11:25
  from just a passive threat into active psychological
• 11:28
  warfare. It gets really nasty. The report outlines
• 11:32
  how shiny hunters turns up the heat if they sense
• 11:34
  hesitation. They utilize DDoS botnets to overwhelm
• 11:39
  and knock the company's public -facing websites
• 11:41
  offline. Yep, completely disrupting their business.
• 11:44
  And they launch massive email bombing campaigns,
• 11:47
  flooding employee inboxes with thousands of messages
• 11:50
  a minute, so the company literally cannot communicate
• 11:53
  internally to coordinate a response. And the
• 11:56
  automation behind those harassment attacks is
• 11:58
  staggering. The threat actors don't do this manually.
• 12:02
  They feed the corporate domain and the scraped
• 12:04
  employee contact lists into stressor services
• 12:07
  available on the dark web. So they basically
• 12:08
  weaponize the company's own infrastructure against
• 12:11
  itself. Right, to create this paralyzing environment
• 12:13
  of chaos, forcing the executive team into a rushed
• 12:16
  panic decision to pay. It even breaches the digital
• 12:19
  divide into physical threats. The report details
• 12:22
  shiny hunters engaging in swatting attacks against
• 12:24
  company executives. Yeah, this is where it crosses
• 12:26
  a major line. They use anonymized VoIP services
• 12:29
  to call local police departments. claiming a
• 12:32
  violent hostage situation or a bomb threat at
• 12:35
  the physical home address of a CEO or board member.
• 12:38
  Swatting is frequently purchased as a service
• 12:40
  in underground forums. The attackers just outsource
• 12:43
  the physical intimidation. That is terrifying.
• 12:45
  It is. Think about it. When you're sitting in
• 12:47
  a boardroom dealing with paralyzed internal communications,
• 12:51
  a downed public website, and the knowledge that
• 12:54
  your family might be targeted by armed police
• 12:57
  at your home. The theoretical advice of a security
• 13:00
  firm feels... Very distant. And that is exactly
• 13:03
  where I want to push back on this hardline stance
• 13:05
  of never negotiate, because it's incredibly easy
• 13:08
  for threat intelligence analysts to sit in a
• 13:11
  secure facility and preach about not funding
• 13:13
  the cybercrime ecosystem. Sure. In theory. Right.
• 13:15
  But if you are ADT's management, you have a fiduciary
• 13:19
  duty to your shareholders and a responsibility
• 13:21
  to five point five million angry customers whose
• 13:24
  home addresses are about to be public. You have
• 13:27
  executives terrified for their physical safety.
• 13:30
  The temptation to quietly authorize a cryptocurrency
• 13:33
  transfer, make the problem go away and protect
• 13:36
  your people. has to be totally overwhelming the
• 13:39
  pressure is definitely unimaginable but the temptation
• 13:41
  relies on a critical fallacy which is the assumption
• 13:45
  that a transaction with a criminal syndicate
• 13:47
  functions like a legitimate business contract
• 13:50
  you are dealing with actors who operate entirely
• 13:53
  outside the bounds of law and ethics right there's
• 13:57
  no honor among thieves exactly there is zero
• 14:00
  cryptographic guarantee that paying the ransom
• 14:02
  results in the deletion of the data The data
• 14:05
  has already been copied. The toothpaste is out
• 14:07
  of the tube. And this introduces the reality
• 14:09
  of double extortion, which has completely upended
• 14:12
  the cyber insurance industry over the last few
• 14:14
  years. Precisely. A company pays the initial
• 14:16
  ransom, believing the crisis is averted. Six
• 14:19
  months later, the same group or an affiliate
• 14:21
  who bought the data from them returns and demands
• 14:24
  a second payment to keep the exact same data
• 14:27
  secret. So paying doesn't actually solve anything.
• 14:30
  No, paying doesn't mitigate the risk. It simply
• 14:32
  confirms to the criminal underground that your
• 14:35
  organization is willing and able to pay, effectively
• 14:38
  painting a much larger target on your back for
• 14:41
  future campaigns. It really is an unwinnable
• 14:43
  scenario once the data leaves the network. Which?
• 14:46
  Which I think brings us to the ultimate strategic
• 14:48
  lessons you need to take away from this entire
• 14:50
  sequence of events. Absolutely. Because this
• 14:53
  incident is a masterclass in realizing that the
• 14:56
  modern cybersecurity front line is no longer
• 14:59
  a firewall. or an intrusion detection system
• 15:01
  or some complex cryptographic algorithm. The
• 15:05
  front line is the human being answering the phone
• 15:08
  at the IT help desk. Yeah, and centralized convenience
• 15:10
  tools are non -negotiable for modern business
• 15:13
  operations. I mean, you cannot run a global enterprise
• 15:16
  without SSO or massive CRM platforms. They are
• 15:19
  incredible efficiency drivers. But the architectural
• 15:22
  reality is that they drastically raise the stakes
• 15:24
  of a single compromise session token. When you
• 15:27
  build a system where one human error can compromise
• 15:30
  5 .5 million records, you have built a fragile
• 15:33
  system. If you put all your critical assets in
• 15:35
  one vault and give one person the ability to
• 15:39
  authorize access to that vault based on a phone
• 15:41
  call, you better be absolutely certain nobody
• 15:44
  can manipulate that person. Which is impossible.
• 15:47
  Right. Because as we've seen, human empathy and
• 15:50
  the desire to be helpful are the easiest things
• 15:52
  in the world to manipulate. So, I want to leave
• 15:56
  you with a final provocative concept to mull
• 15:58
  over. Okay, let's hear it. If our strongest,
• 16:01
  most expensive digital parameters can be entirely
• 16:04
  bypassed by an attacker, just asking politely
• 16:06
  over the phone. Perhaps the future of corporate
• 16:09
  security relies less on building higher technological
• 16:11
  walls. That's a good point. Perhaps it requires
• 16:14
  fundamentally redesigning how we distribute trust
• 16:17
  to the humans working inside those walls. We
• 16:20
  have to stop treating employees as the weakest
• 16:22
  link that just needs more training. and start
• 16:24
  designing architectures that assume the human
• 16:26
  will eventually be tricked, strictly limiting
• 16:28
  the blast radius when they inevitably are. It
• 16:31
  really demands a shift toward true zero -trust
• 16:33
  architecture, applied not just to devices and
• 16:36
  network traffic, but implicitly to human roles
• 16:38
  and administrative actions. Security must be
• 16:41
  resilient to human error rather than dependent
• 16:43
  on human perfection. Well said. To ensure your
• 16:46
  organization is building those resilient systems
• 16:48
  and isn't leaving a digital back window wide
• 16:51
  open for an attacker to walk through, you need
• 16:53
  to visit www .kinsoft .com .au. Go there to discuss
• 16:58
  your own security and IT needs with the experts
• 17:00
  who can help you navigate this incredibly complex
• 17:02
  landscape. Keep your parameters secure, but more
• 17:05
  importantly, build systems that survive when
• 17:07
  the perimeter inevitably fails. Thanks for listening.