shinyhunters
ACTIVEransomware group
??ShinyHunters is a prolific data theft and extortion group responsible for numerous high-profile breaches including the 2024 Snowflake customer data campaign affecting Ticketmaster, AT&T, Santander Bank, and hundreds of other organizations. Members have been identified in France and Morocco, with some arrested by French and Moroccan authorities. On August 8, 2025, ShinyHunters merged with Lapsus$ and Scattered Spider to form Scattered LAPSUS$ Hunters (SLH), an extortion-as-a-service supergroup combining automated data theft, advanced social engineering, and coordinated multi-vector extortion operations.
Group Activity
Last 12 monthsVictims (157)
Fresenius Medical Care
You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026
Kimberly-Clark
This is a final warning to reach out by 16 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision...
State of Florida DMV
Contact us, you know how. or we will release the files. View download button below for proof (samples). Deadline : 9 11 2026
Medela.com
This is a final warning to reach out by 08 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision...
Neogen Corporation
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision,...
McKesson Corporation
Hundreds of millions of records/rows of data was compromised containing very sensitive information spanning from PII to PHI. We urge you to reach out. Read our ...
Jack Henry & Associates
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision,...
Elekta AB
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision,...
CyrusOne, LLC.
Update 23 Aug: We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold...
ReliaQuest, LLC
This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for i...
BOK Financial
This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the rig...
NovoCure Limited
This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the rig...
Logitech/ Streamlabs
This is a final warning to reach out by 21 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision...
Baxter International, Inc.
Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along with several annoyi...
Cook Medical LLC
Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers, did not want to pay...
Carhartt, Inc.
Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempted to negotiate with...
NOTICE OF WARNING
We are currently experiencing an influx of volume. More leaks are on their way. Kindly be informed, it is in your best interests to not stall and waste our time...
Sharecare, Inc.
This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for you, that is on you....
Metabase
:P
Questel SAS
Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us ...
Lumenis Ltd.
Over 1.1 million records containing some PII of customers/employees and 177GB+ of internal corporate data was compromised. The Company failed to reach an agree...
Alcon, Inc.
Over 25 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all t...
Brinks Home
Over 4.9 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all ...
Ernst & Young
Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to...
RingCentral, Inc.
Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll com...
BH Security, LLC. (brinkshome.com)
Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several...
Abbott owned Exact Sciences Corporation
You wouldn't want us to describe what was exfiltrated from you publicly. This is a final warning to reach out by 18 July 2026 before we leak along with severa...
Ingram Content Group, Inc.
The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.
Fluke Corporation
Over 21 million Salesforce records containing some PII were compromised. The Company failed to reach an agreement with us despite our incredible patience, all ...
icsecurity.com
Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with sever...
Amazon owned
Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll c...
NAIC.org
Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical platform, Vision cred...
icc.edu
Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (ICC, SURS pension re...
moody.edu
Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and com...
glendale.edu
Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and ...
hccs.edu
Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and ...
kodak.com
Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before ...
Deep Well Services
Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before we leak a...
Sysco Corporation
Over 61 million Salesforce records across several tables, some containing customer data/PII, employee data, and other internal corporate data was compromised. T...
coe.int
Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources, Parliamentary Asse...
Madison Square Garden Sports Corp.
Over 26 million records containing customer PII and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our ...
JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group
Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 tax records, pay data, physical scans of government identity documents, drive licenses, an...
American Tower Corporation
Over 5.2 million records consiting of a significant amount of customer and landowner PII, other records tied to other high profile telecom/ISP companies, severa...
Zayo.com & Allstream.com
You wouldn't want us to describe what data was taken from you publicly here. A fair assessment of this breach in terms of criticality is a 9/10. We urge you to ...
Nexstar.tv
Over 1 million Salesforce records and other internal corporate data containing PII was compromised. This is a final warning to reach out by 14 June 2026 before ...
Ralph Lauren Corporation
Over 220GB of data containing customer PII, purchase/trasnaction info, future unreleased releases from 2027 and onward, and more was compromised. This is a fina...
nottingham.ac.uk
Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the University of Nottingham an...
BCD Travel
Over 700k Salesforce records and various Sharepoint sites corporate data has been compromised. This is a final warning to reach out by 1 June 2026 before we l...
Baker Distributing Company
Over 260k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 27 May 2026 befor...
Charter Communications, Inc.
Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital...
Infrastructure
interaction gate
https://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion2706ms
1d ago
interaction gate
http://shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion2336ms
3h ago
unreachable
http://toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion1864ms
38m ago
unreachable
https://shinyhunte.rs/384ms
14m ago