ThreatPaper

#vishing

4 cases

Astrana Health breach: callers spoofed its main phone number, and the 8-K says less than the headlines

Astrana Health's Item 1.05 8-K (filed September 23, 2026): attackers posing as staff called employees from its spoofed main number, and data on servers was accessed or acquired. Actor, patient count and exfiltration remain unconfirmed.

Data BreachSocial Engineering
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data

ShinyHunters says it vished McKesson employees, took over Okta sessions, and pulled a terabyte from Salesforce and Snowflake between 20 and 25 August 2026. McKesson has confirmed exfiltration of patient data and nothing about how.

Data BreachExtortion & BlackmailSocial Engineering
ShinyHunters Salesforce Data Extortion and SaaS Supply-Chain Campaign (2025–2026)

Between mid-2025 and August 2026, a cybercriminal collective operating primarily under the ShinyHunters brand—alongside associated activity clusters tracked as UNC6040, UNC6240, UNC6395, UNC6661, and...

Data BreachSupply Chain Attack
Apollo Global Management Cloud Data Breach via Voice Phishing

Apollo Global Management confirmed on August 21, 2026 that it had suffered a data breach stemming from a social engineering attack. Between July 6 and July 10, 2026, attackers used voice phishing,...

Data Breach