One of the World's Largest Real Estate Firms Was Breached by a Phone Call. No Malware. No Exploit. Just Someone Picking Up.
In early May 2026, an employee at Cushman & Wakefield — a $10 billion global real estate firm with 52,000 staff — answered a phone call from someone who sounded like IT support. That call led to 500,000 Salesforce records stolen, 50 gigabytes dumped publicly, a class action lawsuit filed within a week, and two ransomware groups claiming the same company simultaneously. The attack didn't require a single line of malicious code.
The 2026 Verizon DBIR documented it. The CISA GitHub leak illustrated it. The McDonald's chatbot confirmed it. Every post in this series has circled the same truth from a different angle: the most dangerous attack vector in 2026 is not a technical exploit — it's a human being who trusted something they shouldn't have.
The Cushman & Wakefield breach is the clearest version of that story yet. No malware was deployed. No zero-day was exploited. No sophisticated technical capability was required. An attacker called an employee, convinced them to hand over credentials or approve an authentication request, and used that one phone call to walk into one of the world's largest commercial real estate firms through the front door.
Cushman & Wakefield confirmed the incident publicly: "Cushman & Wakefield recently became aware of a limited data security incident due to vishing." The group responsible — ShinyHunters, tracked by Google Threat Intelligence as UNC6040 — used that single phone call to exfiltrate more than 500,000 Salesforce records. When ransom negotiations collapsed, they dumped the full 50-gigabyte dataset publicly. Within a week, a class action lawsuit had been filed in the Southern District of New York.
The ShinyHunters playbook — how a phone call becomes a 50GB data dump
ShinyHunters has been responsible for some of the largest data breaches of the past three years — Snowflake, Okta, Sony, AMD, ADT, Ticketmaster, and more than 100 other organizations. What makes their 2025–2026 campaign significant is not the scale. It's the method. Every single breach uses the same sequence, and none of it requires technical sophistication.
This playbook has been used against more than 100 organizations across every industry and every size:
Why this matters if you've never heard of ShinyHunters
Most SMB owners will read "ShinyHunters" and think: that's an enterprise problem. These are major corporations. We're not a target for a group that attacks Snowflake and Ticketmaster.
That assumption is wrong on two counts. First: ShinyHunters is not the only group using this playbook. It is the most documented group using it. Voice phishing as an initial access technique has been adopted across dozens of threat actor groups because it works — bypassing every technical defense because it never touches any of them.
Second: the vishing technique requires no specialized knowledge to execute against a small business. Identifying an employee's name and role, calling from a spoofed number, and asking them to "verify their credentials for a security update" is a script that runs against a 10-person accounting firm as easily as a global real estate company. The script doesn't change. Only the target does.
The four defenses that break this playbook
1. A verbal verification protocol for any IT request by phone
The simplest and most effective defense: a company-wide policy that no employee ever approves an MFA request, shares credentials, or installs software based solely on a phone call — regardless of how legitimate it sounds.
If IT needs something, they submit a ticket. If a caller claims to be IT, the employee hangs up and calls IT back on a known internal number. This policy costs nothing. It breaks every vishing attack at step three.
2. Phishing-resistant MFA — not push notifications
SMS codes and authenticator push notifications can be socially engineered — the attacker asks the employee to read a code aloud or approve a push under urgency. Phishing-resistant MFA — hardware security keys or passkeys — cannot be socially engineered over a phone call because they require physical possession of the device.
CISA recommends phishing-resistant MFA as the minimum standard for any organization with sensitive data. Number matching — the configuration change we covered in the MFA bypass post — significantly raises the difficulty. Hardware keys eliminate the vector entirely.
3. Audit and revoke OAuth tokens regularly
Researchers noted that many organizations targeted in mid-2025 still had not revoked OAuth tokens compromised during that campaign a year later. Once an attacker registers a persistent MFA device through a compromised Okta account, they maintain access until that device is explicitly revoked.
A quarterly audit of all active OAuth tokens, registered MFA devices, and third-party SaaS integrations closes the persistence mechanism the playbook depends on.
4. Vishing-specific training — not just email phishing awareness
Security awareness training that covers email phishing but not voice phishing is training for the wrong attack. The 2026 DBIR confirmed mobile social engineering succeeds at a 40% higher rate than email phishing.
Employees need to know: what a vishing call sounds like, what the common pretexts are (IT support, vendor verification, compliance deadline), and what the correct response is. This training is a 20-minute addition to any existing security awareness program.
The question your business needs to answer today
If someone called your most junior employee right now, identified themselves as your IT provider, said there was an urgent security issue with their account, and asked them to read a verification code — what would they do?
For most small businesses, the honest answer is: they'd read the code. Not because they're careless. Because nobody ever told them not to. Because there's no policy. Because the training they received covered email phishing and stopped there. Because the attacker sounds completely credible and the request sounds completely routine.
That gap — between what your employees would do and what they should do — is the same gap ShinyHunters has exploited across 100+ organizations. Cushman & Wakefield had it. Aura had it. The answer is a 20-minute training session, a one-page policy, and phishing-resistant MFA. Not a security budget. Not a security team. A policy and a training. That's the entire defense.
📚 Credential Security Series — Read the full series
Know where your human risk gaps are before a phone call finds them. Veriti Spottr's beta is free.
Get your CyberScore →
Comments
Post a Comment