Back to Threat Groups

shinyhunters

ACTIVE

ransomware group

πŸ‡€πŸ‡€??

ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2024 Snowflake customer data campaign affecting Ticketmaster, AT&T, Santander Bank, and hundreds of other organizations. Members have been identified in France and Morocco, with some arrested by French and Moroccan authorities. On August 8, 2025, ShinyHunters merged with Lapsus$ and Scattered Spider to form Scattered LAPSUS$ Hunters (SLH), an extortion-as-a-service supergroup combining automated data theft, advanced social engineering, and coordinated multi-vector extortion operations.

Victims
128
records
First Discovered
Oct 3, 2025
victim
Last Discovered
Jun 18, 2026
victim
Inactive Since
8
days
Countries
16
hit
Avg Discount
β€”
no settlements

Group Activity

Last 12 months
Jul
2025
Aug
2025
Sep
2025
46
Oct
2025
Nov
2025
Dec
2025
8
Jan
2026
9
Feb
2026
16
Mar
2026
22
Apr
2026
9
May
2026
18
Jun
2026

Victims (128)

icsecurity.com

shinyhuntersπŸ‡ΊπŸ‡Έ US
8d ago

Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with sever...

TechnologyPublished
icsecurity.com

Amazon owned

shinyhuntersπŸ‡ΊπŸ‡Έ US
8d ago

Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll c...

Healthcare8.8 TBPublished
onemedical.com

NAIC.org

shinyhuntersπŸ‡ΊπŸ‡Έ US
8d ago

Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical platform, Vision cred...

Business ServicesPublished
naic.org

icc.edu

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (ICC, SURS pension re...

EducationPublished
icc.edu

moody.edu

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and com...

EducationPublished
moody.edu

glendale.edu

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and ...

EducationPublished
glendale.edu

hccs.edu

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and ...

EducationPublished
hccs.edu

kodak.com

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before ...

ManufacturingPublished
kodak.com

Deep Well Services

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before we leak a...

EnergyPublished
deepwellservices.com

Sysco Corporation

shinyhuntersπŸ‡ΊπŸ‡Έ US
11d ago

Over 61 million Salesforce records across several tables, some containing customer data/PII, employee data, and other internal corporate data was compromised. T...

Agriculture and Food ProductionPublished
sysco.com

coe.int

shinyhuntersπŸ‡«πŸ‡· FR
12d ago

Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources, Parliamentary Asse...

Published
coe.int

Madison Square Garden Sports Corp.

shinyhuntersπŸ‡ΊπŸ‡Έ US
14d ago

Over 26 million records containing customer PII and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our ...

Consumer Services42 GBPublished
msgsports.com

JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group

shinyhuntersπŸ‡ΊπŸ‡Έ US
14d ago

Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 tax records, pay data, physical scans of government identity documents, drive licenses, an...

Consumer ServicesPublished
catalystbrands.com

American Tower Corporation

shinyhuntersπŸ‡ΊπŸ‡Έ US
14d ago

Over 5.2 million records consiting of a significant amount of customer and landowner PII, other records tied to other high profile telecom/ISP companies, severa...

Telecommunication105 GBPublished

Zayo.com & Allstream.com

shinyhuntersπŸ‡ΊπŸ‡Έ US
14d ago

You wouldn't want us to describe what data was taken from you publicly here. A fair assessment of this breach in terms of criticality is a 9/10. We urge you to ...

TelecommunicationPublished
zayo.com

Nexstar.tv

shinyhuntersπŸ‡ΊπŸ‡Έ US
15d ago

Over 1 million Salesforce records and other internal corporate data containing PII was compromised. This is a final warning to reach out by 14 June 2026 before ...

TechnologyPublished
nexstar.tv

Ralph Lauren Corporation

shinyhuntersπŸ‡ΊπŸ‡Έ US
15d ago

Over 220GB of data containing customer PII, purchase/trasnaction info, future unreleased releases from 2027 and onward, and more was compromised. This is a fina...

RetailPublished
ralphlauren.com

nottingham.ac.uk

shinyhuntersπŸ‡¬πŸ‡§ GB
17d ago

Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the University of Nottingham an...

EducationPublished
nottingham.ac.uk

BCD Travel

shinyhuntersπŸ‡³πŸ‡± NL
28d ago

Over 700k Salesforce records and various Sharepoint sites corporate data has been compromised. This is a final warning to reach out by 1 June 2026 before we l...

Technology9.0Published
bcdtravel.com

Baker Distributing Company

shinyhuntersπŸ‡ΊπŸ‡Έ US
May 23, 2026

Over 260k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 27 May 2026 befor...

Business Services1.0Published
bakerdist.com

Charter Communications, Inc.

shinyhuntersπŸ‡ΊπŸ‡Έ US
May 23, 2026

Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital...

Telecommunication1.0Published
charter.com

DentaQuest, LLC

shinyhuntersπŸ‡ΊπŸ‡Έ US
May 23, 2026

You wouldn't want us to describe what data and how much data was compromised. It is in your best interests to reply to us or we are leaking it all by the deadli...

Healthcare9.0Published
dentaquest.com

Houghton Mifflin Harcourt Company

shinyhuntersπŸ‡ΊπŸ‡Έ US
May 9, 2026

Your data was compromised in several of our campaigns throughout the past few months. We urge you to engage with us, it is in your best interests. This is a f...

Education1.0Published
hmhco.com

Adelante Soluciones Financieras (Addi.com)

shinyhuntersπŸ‡¨πŸ‡΄ CO
May 5, 2026

Over 16M unique persons records containing significant PII, financial/transactions (credit cards), KYC and data from TransUnion and Experian (background checks)...

Financial Services1.0Published
addi.com

Entire list of affected schools by Instructure breach

shinyhunters
May 5, 2026

The download button below is a list of affected schools by the Instructure Canvas LMS data breach. If any of the schools in the file are interested in preventin...

Education1.0Published

Instructure Holdings, Inc. (Canva LMS, instructure.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
May 3, 2026

Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of priva...

Education1.0Published
instructure.com

Cushman & Wakefield Inc.

shinyhuntersπŸ‡ΊπŸ‡Έ US
May 3, 2026

Over 500k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 6 May 2026 before w...

Business Services1.0Published
cushmanwakefield.com

TOWERPOINT WEALTH, LLC

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 30, 2026

Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 2026 before we leak alo...

Finance1.0Published
towerpointwealth.com

Follett Software LLC

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 30, 2026

Over 4M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 2026 before we ...

Education1.0Published
follettsoftware.com

Vimeo, Inc.

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 28, 2026

Your Snowflake and Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 30 Apr 2026 before we le...

Technology1.0Published
vimeo.com

Udemy, Inc. (udemy.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 24, 2026

Over 1.4M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 27 Apr 2026 bef...

Education7.0Published
udemy.com

ADT, Inc. (adt.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 24, 2026

Over 10M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 27 Apr 2026 befo...

Business Services7.0Published
adt.com

Aman Resorts (aman.com)

shinyhuntersπŸ‡ΈπŸ‡¬ SG
Apr 17, 2026

Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with ...

Hospitality and Tourism7.0Published
aman.com

The Canada Life Assurance Company (aman.com)

shinyhuntersπŸ‡¨πŸ‡¦ CA
Apr 17, 2026

Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with ...

Financial Services7.0Published
canadalife.com

Pitney Bowes Inc. (pb.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 17, 2026

Over 25M Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with s...

Business Services7.0Published
pb.com

7-Eleven, Inc. (7-eleven.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 17, 2026

Over 600k Salesforce records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 A...

Consumer Services7.0Published
7-eleven.com

Carnival Corporation & plc (carnivalcorp.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 17, 2026

Over 8.7M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21...

Hospitality and Tourism7.5Published
carnivalcorp.com

Medtronic plc (medtronic.com)

shinyhunters
Apr 17, 2026

Over 9M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 A...

7.0Published
medtronic.com

Zara (zara.com)

shinyhuntersπŸ‡ͺπŸ‡Έ ES
Apr 17, 2026

Your Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with ...

Consumer Services3.0Published
zara.com

Alert 360 Opco Inc. (alert360.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 16, 2026

Over 2.5M records containing PII and other internal corporate data have been compromised. Please read the chatlog of the negociation by cliking the Download b...

Business Services7.0Published
alert360.com

Rockstar Games

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 12, 2026

Your Snowflake instances metrics data was compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak alon...

Technology5.0Published
rockstargames.com

Abrigo, Inc.

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 12, 2026

Over 1.7M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr...

Manufacturing7.0Published
martinscaterers.com

Marcus & Millichap, Inc.

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 12, 2026

Over 30M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr ...

Real Estate Services7.5Published

Kemper Corporation

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 12, 2026

Over 13M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr ...

Financial Services7.0Published

Ryan, LLC.

shinyhunters
Apr 12, 2026

Over 4.8M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr...

Other7.0Published
ryan.com

McGraw Hill, Inc. (mheducation.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 12, 2026

Over 45M Salesforce records containing PII data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along wit...

Technology7.0Published
mheducation.com

National Railroad Passenger Corporation (amtrak.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 12, 2026

Over 9.4M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr...

Transportation/Logistics7.5Published
amtrak.com

Mytheresa

shinyhuntersπŸ‡©πŸ‡ͺ DE
Apr 12, 2026

Sensitive customer PII data and transactional history data was compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak alon...

Consumer Services7.0Published

Cisco Systems, Inc. (cisco.com)

shinyhuntersπŸ‡ΊπŸ‡Έ US
Apr 1, 2026

3 breaches ( UNC6040 , Salesforce Aura, and AWS accounts). Total over 3M Salesforce records containing PII, Github repositories, AWS buckets and other internal ...

Technology7.5Published
cisco.com

Hallmark Cards, Inc. & Hallmark Plus

shinyhuntersπŸ‡ΊπŸ‡Έ US
Mar 31, 2026

Over 7.9M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 2 Apr 2026 before w...

Consumer Services7.0Published

Infrastructure

auto-discovered
ONLINE
http://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion

60060ms

3m ago

leak site
OFFLINE

render failed

http://toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion

3968ms

1h ago

leak site
OFFLINE

render failed

http://shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion

1123ms

1h ago