The Ransom Note Without the Ransomware: Exfiltration-First Extortion in Healthcare

In September 2026 the health-sector information sharing body Health-ISAC warned members about extortion activity carried out by ShinyHunters and clusters assessed to be associated with it. The message was specific: the campaigns combine voice phishing, credential theft and MFA bypass, and the operators in some cases registered their own authentication devices to hold on to the account. No file encryption was involved.

How the intrusion runs

In the flagship case described in that warning, an attacker called an employee posing as IT support and guided them to enter credentials and a one-time code into a counterfeit single sign-on page. With those, the operator enrolled an attacker-controlled device as a second factor and took the organisation's Okta identity platform. From there the path ran through federated services to Salesforce and Snowflake, from which the group extracted more than one terabyte of data and in excess of 200 million records. The published demand was 55 million US dollars. There was no encryption, and cryptographically there was nothing to decrypt.
The pattern is consistent with what MITRE's ATT&CK knowledge base records about the group. Under Data from Cloud Storage, ShinyHunters is documented as collecting data from insecure cloud buckets at rest. Under Exfiltration Over Web Service, it used compromised Salesforce dashboards to export bulk data. Halcyon's profile of the group notes that its primary attack chain relies on credential theft, social engineering and OAuth token abuse rather than vulnerability exploitation, with no CVEs attributed to its operations as of early 2026.
Related cases in the same period follow the same logic. A home-health subsidiary disclosed that 162,000 people were affected after attackers used voice phishing in April to obtain employee credentials and reach a third-party vendor platform. In a separate event involving a hardware wallet vendor and its logistics partner, attackers exploited a SQL injection flaw in a self-hosted analytics platform tracked as CVE-2026-72898 with a CVSS score of 10.0, created an administrator session and exported the order data of about 80,700 users.

Why this model is harder to answer

Encryption-based ransomware forces a decision, and it forces it quickly. Exfiltration-first extortion forces no decision at all until the leak is announced, which means the organisation may not know it is a victim until it is publicly named. Access is held by legitimate means, so there is no malware to remove and no decryption key to negotiate for; the only remediation is revocation and rotation, followed by the incident response of a data breach.
The exposure is also concentrated in a small number of systems. Identity provider, CRM, cloud data warehouse and collaboration suite are the four places where bulk records accumulate, and for most enterprises they are federated so that one identity compromise grants access to all of them. An export action from any of these platforms looks much like a reporting job.
CVE-2026-72898 is the exception in this account, and it carries its own lesson. The only vulnerability in the chain was in an analytics tool the organisation presumably considered internal, and it was rated 10.0.

What to do about it

• Verify out of band, everywhere. The whole intrusion began with a caller whose story could have been checked with a separate message or a known number, and that habit is cheaper than any control.
• Make identity the tier-zero asset. If one compromise reaches every federated application, the identity platform's administrative surface warrants the same level of protection as the domain controllers.
• Watch for new factor registrations and sessions. A newly enrolled authentication device on an existing account is a compact, high-signal detection.
• Baseline bulk export. Data leaving a warehouse or CRM in volumes that differ from the normal pattern is detectable if a normal pattern has been defined.
• Prefer phishing-resistant factors. A FIDO2 key bound to the origin cannot be relayed to a counterfeit login page, which breaks the opening step of this chain.
• Patch internal analytics tooling. CVE-2026-72898 was rated 10.0 and had a public patch; self-hosted tooling behind the perimeter still needs a patching schedule.

The honest limit

Health-ISAC's warning attributes activity to a group that operates as a loose set of clusters, and attribution within that ecosystem is contested. Reported record counts and the size of the demand come from the attacker's own claims and from victim disclosures of varying completeness. The mechanism, however, is documented in enough independent detail to treat it as a template rather than a single event.

References

• Weekly intelligence briefing describing the Health-ISAC warning, the voice-phishing initial access, the Okta compromise and the reported data volume and demand: https://baijiahao.baidu.com/s?id=1875907253704210704
• Analysis of the shift from encryption-centric to exfiltration-centric extortion operations in 2026: https://que.com/the-evolution-of-ransomware-in-2026-from-encryption-to-extortion-ecosystems/
• MITRE ATT&CK entry recording ShinyHunters collection from cloud storage: http://attack.mitre.org/techniques/T1530
• MITRE ATT&CK entry recording exfiltration through compromised Salesforce dashboards: http://attack.mitre.org/techniques/T1567
• Threat-group profile noting the reliance on credential theft, social engineering and OAuth token abuse rather than vulnerability exploitation: https://www.halcyon.ai/threat-group/shinyhunters
• Reporting on the group's coercion tactics against directors and their families: https://krebsonsecurity.com/category/ransomware/