# TINYpulse breach exposes Nintendo employee credentials

Published: 2026-08-25 · Severity: elevated · Sectors: technology, non-profit
Canonical: https://vorant.io/reports/f7a6b9c3-8f43-5a0a-8d5c-8383058a2278/tinypulse-breach-exposes-nintendo-employee-credentials

> TINYpulse platform compromised affecting 1.2M users and 115 Nintendo employees; 32 third-party credentials exposed.

A breach of the TINYpulse employee engagement platform has resulted in unauthorized access to user accounts and sensitive employee data. The incident affected approximately 1.2 million users and compromised credentials for 115 Nintendo employees, along with 32 third-party employee accounts. The breach was disclosed via ransomware threat actors, indicating the compromised credentials may be leveraged for further attacks. TINYpulse is widely used by organizations for employee surveys and engagement management, making this incident significant for any organization using the platform. Defenders should assume credentials obtained from this breach will be used in credential-stuffing attacks, phishing campaigns, or as initial access vectors for targeted intrusions against affected organizations.

## Mentioned in this report

- Threat actors: ShadowByt3$

## Detection guidance (public sample)

### Entra ID Protection Leaked Credentials Risk Detection

ATT&CK: T1589.001

Entra ID Protection flags a user whose valid credentials were found in a leaked-credential source, such as a third-party SaaS breach. The credentials are likely to be used for stuffing or initial access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Entra ID Protection Leaked Credentials Risk Detection
description: Detects an Entra ID Protection risk detection of type leakedCredentials,
  meaning a user's valid credentials appeared in a breach dump (for example a third-party
  SaaS breach such as an employee engagement platform). Treat as a trigger for forced
  password reset and review of recent sign-ins.
tags:
- attack.reconnaissance
- attack.t1589.001
- attack.initial-access
- attack.t1586.003
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: leakedCredentials
  condition: selection
falsepositives:
- Users who reused a personal password that appeared in a public dump and have already
  reset it
- Test accounts seeded with known leaked passwords for security awareness exercises
level: medium
id: ca74fa2c-0dfe-5834-8df4-d8df03747e95
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VElOWXB1bHNlIE5JTlRFTkRPIEJSRUFDSCAobmludGVuZG8uY29tKUBTaGFkb3dCeXQzJA==
```

### Entra ID Sign-in Blocked By Smart Lockout Indicating Credential Stuffing

ATT&CK: T1586.003

Azure AD sign-in events with result code 50053 (account locked after repeated bad passwords). A cluster of these across many accounts suggests credential stuffing with breached credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Entra ID Sign-in Blocked By Smart Lockout Indicating Credential Stuffing
description: Detects Entra ID sign-in failures with ResultType 50053 (IdsLocked, account
  locked by smart lockout after repeated invalid password attempts). Individual events
  are common; alert volume or the number of distinct users over a short window should
  be assessed in the SIEM to identify credential stuffing with breached credentials.
tags:
- attack.credential-access
- attack.t1110.004
- attack.t1586.003
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '50053'
  condition: selection
falsepositives:
- Users repeatedly mistyping passwords or using stale cached credentials on mobile
  devices
- Misconfigured service accounts or legacy applications retrying with an old password
level: medium
id: 72fb6324-2239-5c67-9c15-506df90db340
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VElOWXB1bHNlIE5JTlRFTkRPIEJSRUFDSCAobmludGVuZG8uY29tKUBTaGFkb3dCeXQzJA==
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/VElOWXB1bHNlIE5JTlRFTkRPIEJSRUFDSCAobmludGVuZG8uY29tKUBTaGFkb3dCeXQzJA==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f7a6b9c3-8f43-5a0a-8d5c-8383058a2278/tinypulse-breach-exposes-nintendo-employee-credentials.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup