Brinks Home Data Breach: How ShinyHunters Exploited Microsoft Entra Vishing to Steal 4.9M Records

Brinks Home Data Breach: How ShinyHunters Exploited Microsoft Entra Vishing to Steal 4.9M Salesforce Records

TL;DR: No malware. No exploit. No CVE. ShinyHunters allegedly breached Brinks Home's Salesforce environment using a single vishing phone call against Microsoft Entra ID — and it took a full week to detect.

What happened:

On July 13, 2026, an attacker posing as internal IT support convinced a Brinks Home employee to complete what looked like a routine Entra ID authentication/MFA registration step. That single social engineering call was the entire attack chain — no phishing email, no payload, no exploit code.

From there, the technique follows a pattern now well-documented across 2025-2026 breaches (Google, Qantas, Allianz Life, Adidas, EY, RingCentral):

1. Recon employees via LinkedIn/corporate directories
2. Vishing call impersonating IT support
3. MFA/device registration abuse via Entra ID
4. OAuth Connected App abuse (often Salesforce Data Loader) for bulk export
5. Exfiltration via legitimate API calls that blend into normal traffic

Brinks Home detected the intrusion on July 20 — roughly a week of dwell time — and confirmed the breach publicly on August 1, after ShinyHunters listed them on its extortion leak site with a July 30 ransom deadline.

Allegedly exposed:

• 1.1M+ Salesforce Contact records
• 4,000+ employee PII rows
• 3.8M+ customer support chat logs (Cresta platform)

Why this matters for engineers and SOC teams, not just execs:

This attack succeeds through valid credentials and legitimate API calls — meaning traditional malware/IOC-based detection won't catch it. Detection has to shift toward behavioral and volume-based anomalies: new MFA registrations followed by immediate sign-ins, new OAuth Connected App grants, and abnormal bulk export volume.

In the full write-up I've included ready-to-use KQL (Microsoft Sentinel) and SOQL queries for:

• Detecting MFA registration followed by unusual sign-in
• Flagging bulk Salesforce export spikes via Event Monitoring
• Auditing newly authorized OAuth Connected Apps

Plus a full breakdown of the attack flow, Entra ID + Salesforce log indicators to hunt for, and a 7-point prevention checklist (phishing-resistant MFA, OAuth app restrictions, help desk vishing drills, and more).

Full technical breakdown: https://www.xpert4cyber.com/2026/08/brinks-home-data-breach.html

If your help desk can reset MFA over a phone call, you already have the exact gap ShinyHunters knows how to exploit.