ShinyHunters Claims Breaches of Okta Customers Crunchbase and Betterment

ShinyHunters, a known extortionist group, has claimed responsibility for a recent voice-phishing campaign that compromised Okta customers, specifically targeting Crunchbase and Betterment. On January 20, 2026, the group leaked data from these organizations, confirming access to their systems through stolen Okta single-sign-on codes. The data breaches reportedly involve over 20 million records from Betterment and 2 million from Crunchbase, both containing sensitive personally identifiable information (PII).

SoundCloud was also mentioned in the leaks, with a prior breach affecting about 28 million users, representing around 20 percent of its customer base. The company has acknowledged the situation and is actively investigating the claims made by ShinyHunters.

ShinyHunters has not disclosed how they accessed SoundCloud’s data, but they clarified that it was not through Okta credentials. They hinted at having breached additional companies in the same campaign, although they did not provide specific names or numbers.

Okta Threat Intelligence had previously warned customers about voice-phishing campaigns targeting accounts associated with Google, Microsoft, and Okta. This incident underscores the growing threat of social engineering tactics that exploit single-sign-on systems.

Implications for Users and Organizations

For everyday users and organizations, this incident serves as a stark reminder of the vulnerabilities associated with single-sign-on solutions. Users should be particularly cautious about sharing sensitive information and remain vigilant against phishing attempts.

Organizations should enhance their security measures by implementing multi-factor authentication (MFA) and regularly educating employees about recognizing phishing attempts. Additionally, monitoring for unusual account activity can help mitigate potential risks.

As the threat landscape evolves, it is crucial for organizations to stay informed about the tactics used by threat actors like ShinyHunters. Regular security audits and updates to security protocols can help organizations remain resilient against such attacks.