Back to Threat Groups

shinyhunters

ACTIVE

ransomware group

🇤🇤??

ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2024 Snowflake customer data campaign affecting Ticketmaster, AT&T, Santander Bank, and hundreds of other organizations. Members have been identified in France and Morocco, with some arrested by French and Moroccan authorities. On August 8, 2025, ShinyHunters merged with Lapsus$ and Scattered Spider to form Scattered LAPSUS$ Hunters (SLH), an extortion-as-a-service supergroup combining automated data theft, advanced social engineering, and coordinated multi-vector extortion operations.

Victims
157
records
First Discovered
Oct 3, 2025
victim
Last Discovered
Sep 23, 2026
victim
Inactive Since
8
days
Countries
19
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
Nov
2025
Dec
2025
8
Jan
2026
9
Feb
2026
16
Mar
2026
22
Apr
2026
9
May
2026
18
Jun
2026
6
Jul
2026
19
Aug
2026
4
Sep
2026
Oct
2026

Victims (157)

Fresenius Medical Care

shinyhunters🇩🇪 DE
8d ago

You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026

Healthcare9.0Published

Kimberly-Clark

shinyhunters🇺🇸 US
18d ago

This is a final warning to reach out by 16 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision...

Manufacturing2.0Published
kimberly-clark.com

State of Florida DMV

shinyhunters🇺🇸 US
23d ago

Contact us, you know how. or we will release the files. View download button below for proof (samples). Deadline : 9 11 2026

Government & Defense1.0Published

Medela.com

shinyhunters🇨🇭 CH
24d ago

This is a final warning to reach out by 08 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision...

Healthcare1.0Published
medela.com

Neogen Corporation

shinyhunters🇺🇸 US
Aug 29, 2026

This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision,...

Agriculture and Food Production541 GB1.0Published
neogen.com

McKesson Corporation

shinyhunters🇺🇸 US
Aug 29, 2026

Hundreds of millions of records/rows of data was compromised containing very sensitive information spanning from PII to PHI. We urge you to reach out. Read our ...

Healthcare1.0Published

Jack Henry & Associates

shinyhunters🇺🇸 US
Aug 29, 2026

This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision,...

Financial Services1.0Published

Elekta AB

shinyhunters🇸🇪 SE
Aug 29, 2026

This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision,...

Healthcare1.0Published

CyrusOne, LLC.

shinyhunters🇺🇸 US
Aug 23, 2026

Update 23 Aug: We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold...

Information Technology369.6 GB1.0Published
cyrusone.com

ReliaQuest, LLC

shinyhunters🇺🇸 US
Aug 23, 2026

This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for i...

Technology1.0Published
reliaquest.com

BOK Financial

shinyhunters🇺🇸 US
Aug 22, 2026

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the rig...

Financial Services1.0Published
bokfinancial.com

NovoCure Limited

shinyhunters🇮🇱 IL
Aug 22, 2026

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the rig...

Healthcare1.0Published
novocure.com

Logitech/ Streamlabs

shinyhunters🇨🇭 CH
Aug 18, 2026

This is a final warning to reach out by 21 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision...

Technology1.0Published
logitech.com

Baxter International, Inc.

shinyhunters🇺🇸 US
Aug 18, 2026

Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along with several annoyi...

Healthcare1.0Published
baxter.com

Cook Medical LLC

shinyhunters🇺🇸 US
Aug 18, 2026

Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers, did not want to pay...

Healthcare182 GB1.0Published
cookmedical.com

Carhartt, Inc.

shinyhunters🇺🇸 US
Aug 18, 2026

Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempted to negotiate with...

Retail & E-Commerce50 GB1.0Published3,3 Mio. $
carhartt.com

NOTICE OF WARNING

shinyhunters
Aug 18, 2026

We are currently experiencing an influx of volume. More leaks are on their way. Kindly be informed, it is in your best interests to not stall and waste our time...

1.0Published

Sharecare, Inc.

shinyhunters🇺🇸 US
Aug 18, 2026

This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for you, that is on you....

Healthcare28 GB1.0Published
sharecare.com

Metabase

shinyhunters🇺🇸 US
Aug 18, 2026

:P

Technology1.0Published
metabase.com

Questel SAS

shinyhunters🇫🇷 FR
Aug 18, 2026

Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us ...

147 GB1.0Published
questel.com

Lumenis Ltd.

shinyhunters🇮🇱 IL
Aug 18, 2026

Over 1.1 million records containing some PII of customers/employees and 177GB+ of internal corporate data was compromised. The Company failed to reach an agree...

Technology177 GB1.0Published
lumenis.com

Alcon, Inc.

shinyhunters🇨🇭 CH
Aug 18, 2026

Over 25 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all t...

Healthcare1.0Published
alcon.com

Brinks Home

shinyhunters
Aug 18, 2026

Over 4.9 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all ...

1.0Published

Ernst & Young

shinyhunters🇺🇰 UK
Jul 27, 2026

Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to...

Professional Services1.0Published
ey.com

RingCentral, Inc.

shinyhunters🇺🇸 US
Jul 27, 2026

Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll com...

Technology1.0Published
ringcentral.com

BH Security, LLC. (brinkshome.com)

shinyhunters🇺🇸 US
Jul 27, 2026

Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several...

Professional Services1.0Published
brinkshome.com

Abbott owned Exact Sciences Corporation

shinyhunters🇺🇸 US
Jul 15, 2026

You wouldn't want us to describe what was exfiltrated from you publicly. This is a final warning to reach out by 18 July 2026 before we leak along with severa...

Healthcare1.0Published

Ingram Content Group, Inc.

shinyhunters🇺🇸 US
Jul 6, 2026

The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Professional Services1.0Published
ingramcontent.com

Fluke Corporation

shinyhunters🇺🇸 US
Jul 6, 2026

Over 21 million Salesforce records containing some PII were compromised. The Company failed to reach an agreement with us despite our incredible patience, all ...

Manufacturing100 GB5.0Published
fluke.com

icsecurity.com

shinyhunters🇺🇸 US
Jun 18, 2026

Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with sever...

Technology1.0Published
icsecurity.com

Amazon owned

shinyhunters🇺🇸 US
Jun 18, 2026

Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll c...

Healthcare8.8 TB1.0Published
onemedical.com

NAIC.org

shinyhunters🇺🇸 US
Jun 18, 2026

Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical platform, Vision cred...

Business Services3.1 TB1.0Published
naic.org

icc.edu

shinyhunters🇺🇸 US
Jun 15, 2026

Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (ICC, SURS pension re...

Education28 GB1.0Published
icc.edu

moody.edu

shinyhunters🇺🇸 US
Jun 15, 2026

Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and com...

Education23 GB1.0Published
moody.edu

glendale.edu

shinyhunters🇺🇸 US
Jun 15, 2026

Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and ...

Education62 GB7.5Published
glendale.edu

hccs.edu

shinyhunters🇺🇸 US
Jun 15, 2026

Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and ...

Education1.0Published
hccs.edu

kodak.com

shinyhunters🇺🇸 US
Jun 15, 2026

Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before ...

Manufacturing1.0Published
kodak.com

Deep Well Services

shinyhunters🇺🇸 US
Jun 15, 2026

Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before we leak a...

Energy1.0Published
deepwellservices.com

Sysco Corporation

shinyhunters🇺🇸 US
Jun 15, 2026

Over 61 million Salesforce records across several tables, some containing customer data/PII, employee data, and other internal corporate data was compromised. T...

Agriculture and Food Production1.0Published
sysco.com

coe.int

shinyhunters🇫🇷 FR
Jun 14, 2026

Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources, Parliamentary Asse...

Government & Defense297 GB1.0Published
coe.int

Madison Square Garden Sports Corp.

shinyhunters🇺🇸 US
Jun 12, 2026

Over 26 million records containing customer PII and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our ...

Consumer Services42 GB1.0Published
msgsports.com

JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group

shinyhunters🇺🇸 US
Jun 12, 2026

Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 tax records, pay data, physical scans of government identity documents, drive licenses, an...

Consumer Services1.0Published
catalystbrands.com

American Tower Corporation

shinyhunters🇺🇸 US
Jun 12, 2026

Over 5.2 million records consiting of a significant amount of customer and landowner PII, other records tied to other high profile telecom/ISP companies, severa...

Telecommunication105 GB8.0Published

Zayo.com & Allstream.com

shinyhunters🇺🇸 US
Jun 12, 2026

You wouldn't want us to describe what data was taken from you publicly here. A fair assessment of this breach in terms of criticality is a 9/10. We urge you to ...

Telecommunication1.0Published
zayo.com

Nexstar.tv

shinyhunters🇺🇸 US
Jun 11, 2026

Over 1 million Salesforce records and other internal corporate data containing PII was compromised. This is a final warning to reach out by 14 June 2026 before ...

Technology1.0Published
nexstar.tv

Ralph Lauren Corporation

shinyhunters🇺🇸 US
Jun 11, 2026

Over 220GB of data containing customer PII, purchase/trasnaction info, future unreleased releases from 2027 and onward, and more was compromised. This is a fina...

Retail220 GB1.0Published
ralphlauren.com

nottingham.ac.uk

shinyhunters🇬🇧 GB
Jun 9, 2026

Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the University of Nottingham an...

Education40 GB7.0Published
nottingham.ac.uk

BCD Travel

shinyhunters🇳🇱 NL
May 29, 2026

Over 700k Salesforce records and various Sharepoint sites corporate data has been compromised. This is a final warning to reach out by 1 June 2026 before we l...

Technology9.0Published
bcdtravel.com

Baker Distributing Company

shinyhunters🇺🇸 US
May 23, 2026

Over 260k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 27 May 2026 befor...

Business Services1.0Published
bakerdist.com

Charter Communications, Inc.

shinyhunters🇺🇸 US
May 23, 2026

Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital...

Telecommunication1.0Published
charter.com

Infrastructure

leak site
ONLINE

interaction gate

https://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion

2706ms

1d ago

leak site
ONLINE

interaction gate

http://shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion

2336ms

3h ago

leak site
OFFLINE

unreachable

http://toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion

1864ms

38m ago

leak site
OFFLINE

unreachable

https://shinyhunte.rs/

384ms

14m ago