shinyhunters
ACTIVEransomware group
??ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2024 Snowflake customer data campaign affecting Ticketmaster, AT&T, Santander Bank, and hundreds of other organizations. Members have been identified in France and Morocco, with some arrested by French and Moroccan authorities. On August 8, 2025, ShinyHunters merged with Lapsus$ and Scattered Spider to form Scattered LAPSUS$ Hunters (SLH), an extortion-as-a-service supergroup combining automated data theft, advanced social engineering, and coordinated multi-vector extortion operations.
Group Activity
Last 12 monthsVictims (128)
icsecurity.com
Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with sever...
Amazon owned
Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll c...
NAIC.org
Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical platform, Vision cred...
icc.edu
Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (ICC, SURS pension re...
moody.edu
Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and com...
glendale.edu
Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and ...
hccs.edu
Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and ...
kodak.com
Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before ...
Deep Well Services
Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before we leak a...
Sysco Corporation
Over 61 million Salesforce records across several tables, some containing customer data/PII, employee data, and other internal corporate data was compromised. T...
coe.int
Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources, Parliamentary Asse...
Madison Square Garden Sports Corp.
Over 26 million records containing customer PII and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our ...
JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group
Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 tax records, pay data, physical scans of government identity documents, drive licenses, an...
American Tower Corporation
Over 5.2 million records consiting of a significant amount of customer and landowner PII, other records tied to other high profile telecom/ISP companies, severa...
Zayo.com & Allstream.com
You wouldn't want us to describe what data was taken from you publicly here. A fair assessment of this breach in terms of criticality is a 9/10. We urge you to ...
Nexstar.tv
Over 1 million Salesforce records and other internal corporate data containing PII was compromised. This is a final warning to reach out by 14 June 2026 before ...
Ralph Lauren Corporation
Over 220GB of data containing customer PII, purchase/trasnaction info, future unreleased releases from 2027 and onward, and more was compromised. This is a fina...
nottingham.ac.uk
Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the University of Nottingham an...
BCD Travel
Over 700k Salesforce records and various Sharepoint sites corporate data has been compromised. This is a final warning to reach out by 1 June 2026 before we l...
Baker Distributing Company
Over 260k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 27 May 2026 befor...
Charter Communications, Inc.
Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital...
DentaQuest, LLC
You wouldn't want us to describe what data and how much data was compromised. It is in your best interests to reply to us or we are leaking it all by the deadli...
Houghton Mifflin Harcourt Company
Your data was compromised in several of our campaigns throughout the past few months. We urge you to engage with us, it is in your best interests. This is a f...
Adelante Soluciones Financieras (Addi.com)
Over 16M unique persons records containing significant PII, financial/transactions (credit cards), KYC and data from TransUnion and Experian (background checks)...
Entire list of affected schools by Instructure breach
The download button below is a list of affected schools by the Instructure Canvas LMS data breach. If any of the schools in the file are interested in preventin...
Instructure Holdings, Inc. (Canva LMS, instructure.com)
Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of priva...
Cushman & Wakefield Inc.
Over 500k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 6 May 2026 before w...
TOWERPOINT WEALTH, LLC
Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 2026 before we leak alo...
Follett Software LLC
Over 4M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 2026 before we ...
Vimeo, Inc.
Your Snowflake and Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 30 Apr 2026 before we le...
Udemy, Inc. (udemy.com)
Over 1.4M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 27 Apr 2026 bef...
ADT, Inc. (adt.com)
Over 10M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 27 Apr 2026 befo...
Aman Resorts (aman.com)
Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with ...
The Canada Life Assurance Company (aman.com)
Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with ...
Pitney Bowes Inc. (pb.com)
Over 25M Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with s...
7-Eleven, Inc. (7-eleven.com)
Over 600k Salesforce records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 A...
Carnival Corporation & plc (carnivalcorp.com)
Over 8.7M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21...
Medtronic plc (medtronic.com)
Over 9M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 A...
Zara (zara.com)
Your Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with ...
Alert 360 Opco Inc. (alert360.com)
Over 2.5M records containing PII and other internal corporate data have been compromised. Please read the chatlog of the negociation by cliking the Download b...
Rockstar Games
Your Snowflake instances metrics data was compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak alon...
Abrigo, Inc.
Over 1.7M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr...
Marcus & Millichap, Inc.
Over 30M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr ...
Kemper Corporation
Over 13M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr ...
Ryan, LLC.
Over 4.8M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr...
McGraw Hill, Inc. (mheducation.com)
Over 45M Salesforce records containing PII data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along wit...
National Railroad Passenger Corporation (amtrak.com)
Over 9.4M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr...
Mytheresa
Sensitive customer PII data and transactional history data was compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak alon...
Cisco Systems, Inc. (cisco.com)
3 breaches ( UNC6040 , Salesforce Aura, and AWS accounts). Total over 3M Salesforce records containing PII, Github repositories, AWS buckets and other internal ...
Hallmark Cards, Inc. & Hallmark Plus
Over 7.9M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 2 Apr 2026 before w...
Infrastructure
human verification
http://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion7923ms
43m ago
render failed
http://toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion3968ms
39m ago
render failed
http://shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion1123ms
41m ago