On 4 June 2026 the threat-intelligence community confirmed what incident responders had been seeing for three weeks: **ShinyHunters has pivoted to mid-market SaaS extortion at industrial scale.** The campaign chains a freshly disclosed Oracle PeopleSoft vulnerability (CVE-2026-35273, CVSS 9.8) with credential stuffing and OAuth token abuse against Salesforce, Microsoft 365, HubSpot and Zendesk tenants. Confirmed victims in the first 14 days included 41 SMBs and mid-market firms across the EU, the UK and North America, with extortion demands ranging from $80,000 to $1.4M.
The pattern matters more than any individual breach: ShinyHunters is no longer chasing Fortune 500 trophies. They are running a volume play against companies with fewer than 500 employees, where the security team is one or two people and the SaaS estate has grown faster than the controls around it. **The 2026 Verizon DBIR reports ransomware in 88% of SMB breaches and 75% of SMB executives now rank cyberattacks as their top operational threat — ahead of inflation, talent and demand.**
This is the playbook we run at [Call IT Dev](https://callitdev.com) when a client says "harden us before the auditor or the attacker finds us." Ten steps, ordered by ratio of risk reduction to effort, all executable inside two sprints. Some steps you can do in-house. Others — especially the AppSec and pentest steps — are where bringing in an external team pays for itself in the first month.
For an extortion crew, CRM and ERP data has three properties that make it ideal raw material. It contains personally identifiable information that triggers regulatory notification timers (GDPR 72 hours, CCPA, NIS2). It contains commercial information that competitors and short-sellers will pay for. And it sits behind credentials and tokens that are systematically under-monitored — most SMBs cannot tell you how many third-party apps have read access to their Salesforce or Microsoft 365 tenant today, let alone whether any of those tokens are still needed.
CVE-2026-35273 is the accelerant. It is an unauthenticated remote code execution flaw in PeopleSoft's Integration Broker that gives an attacker domain admin equivalence on the application tier within seconds. From there, lateral movement to the database, to the SSO provider and outward to integrated SaaS tenants is a matter of hours, not weeks. Oracle issued an emergency patch on 6 June; **as of 11 June only 31% of exposed PeopleSoft instances were patched.**
If you run PeopleSoft, stop reading and patch now, then come back.
CVE-2026-35273 is the headline, but the same playbook covers any Critical CVE on internet-facing software. Inventory every public-facing application (you probably have more than you think — Shadow IT, marketing landing pages, partner portals). Cross-reference against the CISA Known Exploited Vulnerabilities catalog and your vendor advisories. **Define a 7-day SLA for Critical and 30 days for High.** Anything older than 30 days on Critical is a board-level escalation. Most SMB breaches in 2025 and the first half of 2026 exploited a vulnerability for which a patch had existed for more than 90 days.
Passwords plus SMS codes are no longer multi-factor — they are single-factor with extra friction. ShinyHunters bypasses SMS MFA routinely through SIM-swap and adversary-in-the-middle phishing kits (Evilginx, Modlishka). Move every privileged account to **hardware-backed MFA: FIDO2 security keys (YubiKey, Titan) or platform passkeys.** Microsoft 365, Google Workspace, Salesforce, GitHub, AWS, Cloudflare and Okta all support this in 2026. Cost is roughly €45 per user per year if you supply two YubiKeys per admin. The ROI is a single avoided breach.
This is the highest-impact, lowest-effort step and the one most teams skip. In Salesforce go to Setup → Connected Apps OAuth Usage. In Microsoft 365 go to Entra ID → Enterprise Applications. In HubSpot go to Settings → Integrations → Connected Apps. For each one, ask: do we still use this? Does it need this scope? When was the token last rotated? Revoke aggressively. Rotate everything older than 12 months. **The average SMB Salesforce tenant has 27 connected apps; 8 of them have not been used in 90 days and 3 have admin-equivalent scopes the business never approved.**
The default Salesforce, Microsoft 365 and HubSpot role assignments err on the side of permissive. Audit every user and ask whether they need their current role or a smaller one. Move ex-employees and contractors to a deprovisioning queue with a 7-day SLA. Disable inactive accounts (no login in 60 days). For privileged roles — System Administrator, Global Admin, Sandbox Admin — implement Just-In-Time elevation through Azure PAM, Salesforce Permission Set Groups or your IAM platform. Standing privileged access is the single biggest blast-radius multiplier in an SMB breach.
Manual auditing of SaaS tenants stops scaling above 10 connected apps. SSPM tools (Adaptive Shield, AppOmni, Obsidian, Wing Security) continuously monitor configuration drift, risky integrations and identity posture across your SaaS estate. SMB-tier pricing starts around €1,800 per month for up to 250 users and 30 apps. That is roughly one day of incident-response retainer if you stay ahead of trouble, and a fraction of the cost if you do not.
If you cannot answer "who accessed this Salesforce report at 03:14 last Saturday and from where" in under 90 seconds, you have a detection gap. Stream identity, SaaS and infrastructure logs into a SIEM or a managed XDR. The 2026 SMB-friendly options (Microsoft Sentinel pay-as-you-go, Sumo Logic, Cribl, Elastic Cloud, Panther) are within budget. Define five high-signal alerts: impossible-travel sign-ins, OAuth consent for a new high-scope app, mass-download events (>1,000 records in 10 minutes), inbox forwarding rule creation, privilege elevation outside maintenance windows. Tune them weekly.
A generic compliance pentest tells you what the scanner already told you. A focused pentest scopes specifically to your CRM and ERP attack surface: the OAuth flows, the SSO integration, the file-share connectors, the public APIs, the admin console. Two to three weeks of work, €18k–€45k for an SMB-sized scope, and the findings are actionable inside one sprint. We run these for clients as part of the [Cybersecurity & AppSec service](https://callitdev.com/en/services/digital-studio/cybersecurity-appsec), with a fixed-price pilot designed for SMBs that have never had a pentest before.
Most SMBs have an IT incident runbook from 2018 that assumes everything important is on a server in a closet. Rewrite it for the SaaS-first reality. Define: who has emergency owner access to each tenant if the main admin is compromised, how you rotate every OAuth token in under 60 minutes, who notifies regulators and customers, where the forensic logs live, which external IR firm is on retainer. Tabletop the runbook quarterly. The first time you run the playbook should not be the real incident.
Annual click-through compliance training does nothing against modern phishing. Replace it with quarterly micro-training (10 minutes, focused on the actual lures of the moment: MFA fatigue prompts, OAuth consent phishing, deepfake voice calls impersonating the CEO, Slack DM impersonation of IT). Run a phishing simulation every six weeks with realistic lures. **The benchmark to beat is a click-rate below 6% on phishing simulations within four quarters.**
The 2026 cyber insurance market has hardened. Carriers now demand evidence of MFA, EDR, immutable backups, 24/7 monitoring and a tested incident-response plan. If your renewal is in the next six months, do the work on steps 1 through 9 first — you will get a meaningfully lower premium. A typical SMB policy at €2M coverage costs €8k–€18k per year for a well-secured stack and €35k–€60k for a poorly-secured one. The premium delta funds the entire program.
Three signals say you have outgrown DIY security and need a specialist partner.
**Signal 1 — Your SaaS estate is larger than your security team can audit in a week.** If you have more than 25 connected apps across Salesforce, Microsoft 365 and HubSpot, manual auditing has broken. You need either SSPM tooling plus the headcount to operate it, or an external partner who runs the audit on a quarterly cadence and hands you a remediation backlog.
**Signal 2 — You ship internet-facing software but have never had a code-level security review.** Static analysis (SAST) and dynamic analysis (DAST) tooling is cheap; the expertise to interpret the findings, prioritise them and ship the fixes is not. An external AppSec partner saves you from both false positives (every team's biggest time sink) and false negatives (the bug that gets you breached).
**Signal 3 — A customer or a regulator just asked for a SOC 2, ISO 27001 or NIS2 attestation.** You cannot improvise your way to a clean audit. Bringing in a partner who has run the playbook 20 times is the difference between three months of work and 18 months of work.
The [Cybersecurity & AppSec service at Call IT Dev](https://callitdev.com/en/services/digital-studio/cybersecurity-appsec) runs all three: continuous SaaS posture audit, fixed-price pentest packages for SMBs and mid-market, and audit-ready engineering for SOC 2, ISO 27001 and NIS2. We pair the security work with [24/7 IT helpdesk and technical support](https://callitdev.com/en/services/bpo/technical-support) from Casablanca and Madrid, so incident detection turns into incident response without a 4-hour gap.
**Mistake 1 — Paying the ransom without verification.** ShinyHunters has a documented history of releasing data even after payment. Engage law enforcement and a reputable incident-response firm before any payment decision.
**Mistake 2 — Notifying customers before you understand scope.** A premature notification with the wrong numbers creates a second crisis when you have to correct it. Take the 72 hours the regulator gives you to scope properly, then notify with accurate facts.
**Mistake 3 — Cutting security investment after the breach.** Counterintuitive, but real: many SMBs freeze security spending after a breach because budgets are tight from the response. That is exactly when the attackers come back, because they know the defender is depleted. Maintain or increase investment for at least 12 months after any material incident.
If you do nothing else after reading this, do these four things by Friday: patch any internet-facing system with a Critical CVE older than 30 days; enforce hardware MFA on every admin account; audit and revoke unused OAuth tokens in Salesforce, Microsoft 365 and HubSpot; book a tabletop exercise of your SaaS breach runbook. That covers roughly 70% of the ShinyHunters attack path.
For everything beyond that — the SSPM rollout, the pentest, the audit-ready engineering — talk to a specialist. WhatsApp us at [+212 537 373 777](https://wa.me/212537373777), or [book a free 15-minute security scoping call](https://callitdev.com/en/contact) and we will tell you within the call whether you need us or whether your existing team can run the playbook in-house.
**Are SMBs really being targeted more than enterprises?** Yes. The 2026 Verizon DBIR confirms SMBs now account for 61% of confirmed extortion victims, up from 43% in 2024. The attacker economics favour volume.
**How much does this 10-step program cost an SMB?** Internal cost is mostly time — typically 60–90 engineering hours over two sprints. External cost depends on which steps you outsource. SSPM tooling, a focused pentest and an AppSec retainer for a 100-person SMB land in the €60k–€110k range for year one.
**What if we are already PCI-DSS or SOC 2 compliant?** Compliance does not equal security. Most breached SMBs of 2025–2026 held at least one active certification. Use this playbook to close the gap the certification did not catch.
**Can the helpdesk team detect a breach in progress?** A trained tier-1 helpdesk does spot the early signals: unusual ticket patterns, suspicious password-reset requests, customers reporting unsolicited 2FA prompts. We train our [24/7 helpdesk and technical support agents](https://callitdev.com/en/services/bpo/technical-support) to surface those signals to the security team within 15 minutes.
**Do you offer a fixed-price pentest for SMBs?** Yes. Our SMB pentest pilot covers a defined CRM and ERP attack surface for €19,500, with a 3-week turnaround and a remediation workshop included. Reach out for current availability.
Yes. The 2026 Verizon DBIR confirms SMBs now account for 61% of confirmed extortion victims, up from 43% in 2024. The attacker economics favour volume.
Internal cost is mostly time — typically 60–90 engineering hours over two sprints. External cost depends on which steps you outsource. SSPM tooling, a focused pentest and an AppSec retainer for a 100-person SMB land in the €60k–€110k range for year one.
Compliance does not equal security. Most breached SMBs of 2025–2026 held at least one active certification. Use this playbook to close the gap the certification did not catch.
A trained tier-1 helpdesk does spot the early signals: unusual ticket patterns, suspicious password-reset requests, customers reporting unsolicited 2FA prompts.
Yes. Our SMB pentest pilot covers a defined CRM and ERP attack surface for €19,500, with a 3-week turnaround and a remediation workshop included.
CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777