On April 20, 2026, threat actor ShinyHunters compromised an ADT employee’s Okta SSO account via a vishing attack, then used that session to exfiltrate records on approximately 5.5 million individuals from ADT’s Salesforce environment. When ADT declined to pay ransom, ShinyHunters publicly released an 11GB archive; Have I Been Pwned has confirmed the breach scale. The same Okta-to-SaaS attack pattern has hit multiple enterprise targets including McGraw Hill, the European Commission, and Medtronic, meaning any organization running Okta-federated SaaS without phishing-resistant MFA is an active target.