What the Reported FBI Breach Can Teach Small Businesses About Cloud Security.

The hacking group ShinyHunters claimed it breached systems belonging to the FBI.

According to the group, it exploited a previously unknown vulnerability in Oracle PeopleSoft and then moved laterally into FBI-managed AWS GovCloud infrastructure, where it claims to have stolen sensitive information belonging to employees and job applicants.

The FBI has acknowledged that it is investigating claims of unauthorized activity affecting FBIJobs.gov, but it has not confirmed the full scope of ShinyHunters' claims. Security researchers and journalists are still working to determine exactly what happened and how far the attackers were able to get.

But regardless of what the investigation ultimately finds, the incident is a good reminder of something businesses of every size need to understand:

**Your security is only as strong as the configurations you set for hour applications and identities.

Who are ShinyHunters?

ShinyHunters is a cybercriminal group that has been active since around 2019 and is known primarily for large-scale data theft and extortion.

The group has targeted organizations across technology, finance, education, retail, and other industries.

One of the reasons ShinyHunters is particularly interesting from a small-business perspective is that its attacks don't always start with someone "hacking" through a firewall.

Increasingly, groups operating in this ecosystem go after users by phishing or social engineering.

They may impersonate IT support, call an employee, send them to a convincing fake sign-in page, and convince them to enter their username, password, or MFA information.

Attackers have also used fake passkey, MFA, and single sign-on enrollment pages to compromise Microsoft accounts.

That is important because simply having MFA enabled doesn't automatically make an organization immune to phishing.

Some authentication methods can still be phished or socially engineered. Once an attacker obtains a valid session or identity, they may be able to access the same cloud applications and data that the compromised user can access.

For a small business, since some users wear multiple hats, they have access into most systems like outlook, OneDrive, SharePoint, accounting and more.

What can I do to protect my business?

Most business owners just want to run the business, not spend their Friday night reading Microsoft security documentation. Fair enough, but there are still a few things worth checking.

Some of these you can do yourself. Others are questions for whoever manages your Microsoft 365 environment. Either way, you should have an answer beyond "I think that's set up."

Make sure your employees know when to stop and ask

If someone calls claiming to be IT support and asks an employee to sign in, share a code, or change their security settings, they should stop and verify who they're talking to.

Call your usual IT contact using a number you already have. Not the number the person on the phone just gave you, and not the one in the suspicious email. Microsoft recommends verifying suspicious requests through a separate, trusted contact method.

You can send your team a simple reminder:

If you get an unexpected request to sign in, approve something, or change your account security, check with our usual IT contact first. If you already followed the instructions, tell us right away.

That last part matters to me. I'd rather someone tell me they clicked something than sit there worrying about getting in trouble.

Check that MFA is actually required

"We have Microsoft Authenticator" is a starting point, but it doesn't tell you whether everyone's account is protected.

Ask whoever manages Microsoft 365 to confirm that MFA is being enforced for your employees and administrators, and to explain any exceptions. Microsoft has different ways to do this depending on your setup and licensing, including security defaults and Conditional Access.

Phishing-resistant MFA for administrator accounts, such as FIDO2 security keys or passkeys is another policy you can use to tighten security. There are stronger options than codes and approval notifications, and the accounts managing your environment are a good place to start.

See who still has access

When was the last time you looked at your list of users? Does Bob from accounting still have an active email even though he left years ago? (Seriously to check).

In the Microsoft 365 admin center, go to Users → Active users, or ask your administrator to review it with you. Look for former employees and contractors who no longer work with the business.

For anyone who should no longer have access, have your administrator complete the offboarding process. That includes blocking sign-in and signing out existing sessions, and revoking any other access to non Microsoft accounts, not just collecting their laptop.

Don't start deleting accounts without checking what email and files the business needs to keep. The goal is to remove their access without losing information you still need.

Going forward, decide who handles this when someone leaves. It shouldn't be something everyone assumes someone else took care of.

Check the laptops and phones accessing your data

Start with a list of the devices your team uses for company email and files. Include personal devices, too.

For company laptops, confirm that security updates are being installed, antivirus protection is active, and encryption is turned on. Ask who checks these things and what happens when a device falls behind.

If you're paying for Business Premium, it includes Microsoft Intune for devices, defender for AV and a whole lot more. Ask whether your company devices are actually enrolled and Antivirus is in place.

For personal phones, ask how company information is protected. Intune can protect work data in supported apps without requiring full management of the employee's phone.

Having the subscription is good. Making sure someone has actually configured the tools is the part worth checking.

You don't have to fix all of this today. Start by writing down what is covered, what you're unsure about, and who is going to follow up.

Please don't start turning on random settings just because they sound more secure. You absolutely can lock yourself out of your Microsoft tenant. Security is important, but let's not make it so secure no one can log in.

The inevitable end-of-article sales pitch

Of course, this is the natural spot for a sales pitch, so I'll keep it short.

ProTechStrategies helps small businesses get more out of Microsoft 365 while keeping their environments secure and manageable.

If you're using Microsoft 365 but aren't sure whether things like Conditional Access, Intune, Defender, or your identity security are configured properly, I can help you figure out where you stand and what actually needs to be fixed.

If you'd like to talk about it, feel free to grab some time on my calendar.