ShinyHunters Breach at AdaptHealth Exposes 4.1 Million Patients — Detection and Hardening Guide for Healthcare Defenders

AdaptHealth, a major U.S. provider of home medical equipment and healthcare-at-home services, has confirmed that a cyberattack discovered in July exposed data belonging to approximately 4.1 million people. The intrusion has been attributed to ShinyHunters, the financially motivated extortion group that has spent 2025 conducting one of the most aggressive SaaS and cloud-data theft campaigns on record — hitting enterprises across retail, aviation, insurance, and now healthcare.

If you operate a healthcare SOC, this is not a story about AdaptHealth. This is a story about a threat actor that has industrialized the theft of customer and patient data from cloud-hosted business applications — and proven that they do not need ransomware, zero-days, or even malware to walk out with millions of records. The AdaptHealth breach should trigger an immediate review of your own exposure: CRM platforms, patient engagement systems, third-party billing vendors, and any SaaS tenant holding PHI.

This post breaks down what we know about the intrusion, how ShinyHunters operates in 2025, and — most importantly — what you can detect and harden in your environment today.

Technical Analysis: How ShinyHunters Steals Data at Scale

The actor and the campaign

ShinyHunters (tracked in various reporting alongside overlapping clusters such as UNC6040 and Scattered Spider-adjacent activity) has shifted decisively away from traditional network intrusion toward identity-based attacks against SaaS platforms. Their 2025 playbook, observed across dozens of confirmed victims, follows a consistent pattern:

1. Voice phishing (vishing) against employees. Operators call help desks and end users, impersonating IT staff, and walk victims through authorizing a malicious connected app or granting access to a cloud tenant. The lures are polished, scripted, and often reference real internal tooling discovered through reconnaissance.
2. Malicious OAuth application consent. Rather than stealing a password, the attacker convinces the victim to authorize a rogue connected application (a lookalike of a legitimate data loader or integration tool). This grants the attacker API-level access to the SaaS tenant that survives password resets and frequently bypasses MFA, because OAuth tokens are issued after authentication completes.
3. Bulk data extraction via legitimate APIs. Once a token or session exists, the group uses standard platform APIs and bulk export functionality — the same APIs your integrations use every day — to pull entire object tables: contacts, patients, accounts, cases, attachments. Because the exfiltration rides legitimate API channels, traditional egress filtering and DLP frequently miss it.
4. Extortion without encryption. ShinyHunters monetizes through direct extortion, threatening public leak or sale of the data. No ransomware deployment, no encryption event, no noisy endpoint telemetry to alert on. The first indication many victims get is the extortion email itself.

Why healthcare is a high-value target

AdaptHealth's exposed population — 4.1 million individuals — reflects what defenders should assume is at stake in any healthcare SaaS tenant: patient names, contact details, dates of birth, medical equipment and treatment information, and potentially insurance identifiers. This data has two monetization paths: extortion of the covered entity, and downstream resale for medical identity theft and insurance fraud, which commands premium prices over financial PII on criminal markets.

Critically, healthcare organizations hold PHI across a sprawling third-party estate: EHR adjunct platforms, patient engagement and scheduling tools, medical billing vendors, durable medical equipment (DME) management systems, and CRM instances used for patient outreach. Every one of those tenants is a ShinyHunters-shaped target.

Exploitation status

• Confirmed active campaign: ShinyHunters' SaaS data-theft operations have been confirmed in the wild throughout 2025 and into 2026, with AdaptHealth among the confirmed healthcare victims.
• No CVE applies: This is an identity and social-engineering-driven intrusion, not a software vulnerability. There is no patch to deploy — the remediation surface is identity architecture, SaaS configuration, and detection coverage.
• Extortion confirmed: Public reporting and victim notifications confirm the group's extortion-driven monetization model.

Defender-relevant observables

Even without malware, this attack chain leaves forensic residue. The detectable behaviors are:

• New or unusual connected app / OAuth consent grants in SaaS audit logs, especially for apps with data-loader-like names or broad API scopes.
• Bulk API job execution (e.g., bulk export or query jobs) from service accounts, unusual source IPs, or outside normal integration windows.
• Anomalous record-access volume by a single user or integration identity in a short window.
• Help desk social engineering pretexts — password resets and MFA resets requested by phone, often with urgency and insider vocabulary.
• Exfiltration to attacker-controlled infrastructure over standard HTTPS (443), blending into normal SaaS traffic.

Detection & Response

The rules below target the identity-abuse and bulk-extraction behaviors central to this campaign. Tune thresholds to your tenant's baseline integration traffic before deploying at high severity.

Sigma

---
title: Suspicious OAuth Consent Grant to New Application
id: 4b2c8f1a-7d3e-4a91-b6c5-9e2f1a8d3c47
status: experimental
description: Detects a user consenting to a newly registered OAuth application, a key step in ShinyHunters-style SaaS intrusions where victims are vished into authorizing rogue connected apps.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.credential_access
  - attack.t1550.001
  - attack.persistence
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName|contains:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add delegated permission grant'
  condition: selection
falsepositives:
  - Legitimate application onboarding by IT
level: high
---
title: Mass Export or Bulk Query of SaaS Records
id: 8c1d4e72-5b6a-4f38-a921-3d7e9c1b5f84
status: experimental
description: Detects abnormally high record read/export volume by a single identity against SaaS or line-of-business application audit telemetry, consistent with ShinyHunters bulk data theft via legitimate APIs.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.collection
  - attack.t1530
logsource:
  category: application
  product: salesforce
detection:
  selection:
    EventType|contains:
      - 'API'
      - 'BulkAPI'
      - 'ReportExport'
      - 'ListViewExport'
  condition: selection
falsepositives:
  - Scheduled integration and ETL jobs (baseline and suppress known service accounts)
level: medium
---
title: Help Desk Credential or MFA Reset Followed by Off-Hours Login
id: 2f9a6c41-b8e3-4d72-95af-6c1b3e8a2d59
status: experimental
description: Detects a password or MFA reset event followed by a successful login from a new source within a short window, a pattern consistent with vishing-driven account takeover used against SaaS tenants.
references:
  - https://attack.mitre.org/techniques/T1656/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1656
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName|contains:
      - 'Reset user password'
      - 'Update user'
      - 'Delete authentication method'
  condition: selection
falsepositives:
  - Routine help desk resets — correlate with sign-in telemetry and phone-verified tickets
level: medium

KQL — Microsoft Sentinel / Defender

This hunt identifies identities reading or exporting SaaS/cloud-stored records at anomalous volume, combined with new OAuth consent grants — the two highest-signal behaviors in this campaign. It assumes Entra ID audit/sign-in logs plus any SaaS audit telemetry ingested via CEF or a connector.

// ShinyHunters-style SaaS data theft hunt: rogue consent + anomalous access volume
let lookback = 14d;
let RogueConsent =
    AuditLogs
    | where TimeGenerated > ago(lookback)
    | where OperationName has_any ("Consent to application", "Add service principal", "Add delegated permission grant")
    | extend InitiatedBy = tostring(InitiatedBy.user.userPrincipalName)
    | extend AppName = tostring(TargetResources[0].displayName)
    | project ConsentTime = TimeGenerated, InitiatedBy, AppName, CorrelationId;
RogueConsent
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | summarize SigninCount = count(), IPs = make_set(IPAddress), Apps = make_set(AppDisplayName)
        by UserPrincipalName, bin(TimeGenerated, 1h)
) on $left.InitiatedBy == $right.UserPrincipalName
| project ConsentTime, InitiatedBy, AppName, SigninCount, IPs, Apps
| sort by ConsentTime desc;
// Second hunt: identities with extreme record access volume in cloud app audit logs (ingest SaaS audit via CEF/API)
CloudAppEvents
| where TimeGenerated > ago(lookback)
| where ActionType has_any ("FileDownloaded", "ExportReport", "BulkApiQuery", "ListViewExport")
| summarize AccessCount = count(), DistinctObjects = dcount(tostring(RawEventData.ObjectId)), SourceIPs = make_set(IPAddress)
    by AccountUpn, bin(TimeGenerated, 1h)
| where AccessCount > 500 or DistinctObjects > 1000
| sort by AccessCount desc;

Velociraptor VQL

For endpoints used by administrators or integration operators, hunt for evidence of bulk data staging and archive creation on local disks — the step between SaaS extraction and exfiltration that frequently lands on a compromised or abused workstation.

-- Hunt for recently created large data exports and archives (staging for exfiltration)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:\Users\*\**\*.{csv,zip,7z,rar,json}', accessor='ntfs')
WHERE Size > 10485760
  AND Mtime > Now() - 1209600
ORDER BY Size DESC
LIMIT 200

Remediation & Verification Script

Use this against Entra ID to enumerate recently consented applications, flag broad data-access scopes, and export a review list. Review every entry before revoking anything.

# Requires: Microsoft.Graph PowerShell SDK (Install-Module Microsoft.Graph)
# Enumerate OAuth grants issued in the last 30 days and flag high-risk scopes
Connect-MgGraph -Scopes "Application.Read.All","DelegatedPermissionGrant.Read.All","Directory.Read.All"

$cutoff = (Get-Date).AddDays(-30)
$highRiskScopes = @('Mail.Read','Files.Read.All','Sites.Read.All','full_access','api','refresh_token','offline_access','Directory.Read.All')

Get-MgOauth2PermissionGrant -All | ForEach-Object {
    $grant = $_
    $sp = Get-MgServicePrincipal -ServicePrincipalId $grant.ClientId -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        AppName        = $sp.DisplayName
        AppId          = $grant.ClientId
        ConsentType    = $grant.ConsentType
        Scopes         = $grant.Scope
        CreatedTime    = $sp.AdditionalProperties.createdDateTime
        PublisherVerif = $sp.VerifiedPublisher.IsVerified
        HighRisk       = ($grant.Scope -split ' ' | Where-Object { $highRiskScopes -contains $_ }).Count -gt 0
    }
} | Where-Object { $_.CreatedTime -gt $cutoff -or $_.HighRisk } |
    Sort-Object HighRisk -Descending | Export-Csv -Path ".\OAuth_Grant_Review_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# To revoke a confirmed malicious grant (after IR scoping):
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <grantId>
# Remove-MgServicePrincipal -ServicePrincipalId <clientSpId>
Write-Output "Export complete. Cross-reference against help desk ticket logs and vishing reports before revoking."

Remediation

There is no patch for this campaign — the remediation surface is identity, SaaS configuration, and third-party governance. Prioritize the following:

1. Lock down OAuth consent. Disable user consent to third-party applications entirely, or restrict it to verified publishers with admin-consent workflows (Entra ID: Enterprise applications → Consent and permissions). In Salesforce and similar platforms, restrict connected-app creation and require admin pre-approval for API-enabled apps. Audit all existing grants — anything with broad API scopes issued in the last 12 months deserves scrutiny.
2. Deploy phishing-resistant MFA for anyone with data access. FIDO2/security keys for administrators, help desk staff, and SaaS power users. Remember: OAuth-token theft bypasses MFA after consent — which is why step 1 matters more than step 2 for this actor.
3. Harden the help desk against vishing. Enforce out-of-band identity verification (manager callback, hardware token display, ID verification workflow) for all password resets, MFA resets, and device registrations. ShinyHunters' initial access almost universally runs through a phone call. Log and alert on every reset, and require a verified ticket reference.
4. Instrument SaaS audit logging now. Enable and centralize event/audit logs for every tenant holding PHI (CRM, patient engagement, billing). Alert on bulk API jobs, report exports, login-from-new-IP for integration accounts, and per-identity access-volume anomalies. Route these into your SIEM — SaaS tenants are routinely the least-monitored tier of the healthcare attack surface.
5. Constrain integration identities. Scope service accounts to minimum API permissions, bind them to known IP ranges where the platform supports it, and rotate credentials. A compromised integration token should not be able to dump the entire patient object.
6. Review third-party and BA-covered SaaS exposure. AdaptHealth's scale is a reminder that business associates and platform vendors hold your patients' data too. Verify breach notification SLAs in BAAs, demand audit-log access or attestations, and inventory which vendors can bulk-export your PHI.
7. If you are breached: execute HIPAA notification discipline. Notify HHS OCR without unreasonable delay (no later than 60 days from discovery for breaches affecting 500+ individuals), notify affected individuals and prominent media, engage counsel on state notification statutes (many impose shorter windows), and preserve SaaS audit logs and telephony records as forensic evidence before retention windows expire.
8. Prepare for the extortion phase. Pre-build decision frameworks and executive comms templates for data-theft extortion. Know your cyber insurance extortion coverage terms before you need them. The absence of ransomware does not mean the absence of an incident — it means the incident is quieter and longer.

Final Assessment

The AdaptHealth breach is not an anomaly — it is a data point in a campaign that has made SaaS identity abuse the highest-yield intrusion path of 2025–2026. Healthcare organizations that have invested heavily in endpoint detection and network controls while leaving their cloud tenants instrumented with default logging are precisely the organizations ShinyHunters is built to victimize. Close the consent gap, harden the help desk, and get your SaaS telemetry into the SOC this quarter.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub