ShellCodeX
Tools โ€ข Events โ€ข News โ€ข Insights
SEO Checker
Threat Group Profile

shinyhunters

โ— Active โ€” last 30 days
Victim claims 69
First seen Nov 2023
Last activity 23 Aug 2026
Tracked since Oct 2025

Group overview

ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.

Preferred targets

Technology ยท 12 Education ยท 10 Business Services ยท 9 Healthcare ยท 9 Financial Services ยท 7 Consumer Services ยท 7

Most targeted countries

US ยท 51 FR ยท 2 CH ยท 2 IL ยท 2 GB ยท 1 CO ยท 1

Tactics & techniques (MITRE ATT&CK)

Initial Access

Unsecured Credentials: Private Keys Phishing: Spearphishing Voice (Vishing)

Defense Evasion

Use Alternate Authentication Material: Application Access Token

Collection

Data from Information Repositories

Exfiltration

Exfiltration Over Web Service

Impact

Data Encrypted for Impact

Reconnaissance

Phishing for Information: Spearphishing Attachment

Victim Claims Timeline

Back to radar
๐Ÿ‡บ๐Ÿ‡ธ United States

CyrusOne, LLC. NEW

cyrusone.com

Update 23 Aug : We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 mil...

Technology
๐Ÿ‡บ๐Ÿ‡ธ United States

ReliaQuest, LLC

reliaquest.com

This time the post is about you , not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for information...

Technology
๐Ÿ‡ฎ๐Ÿ‡ฑ Israel

NovoCure Limited

novocure.com

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decisio...

Healthcare
๐Ÿ‡บ๐Ÿ‡ธ United States

BOK Financial

bokfinancial.com

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decisio...

Financial Services
Unknown

Cyrus******

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decisio...

Technology
๐Ÿ‡จ๐Ÿ‡ญ Switzerland

Logitech/ Streamlabs

logitech.com

This is a final warning to reach out by 21 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be...

Technology
๐Ÿ‡บ๐Ÿ‡ธ United States

Metabase

metabase.com

:P | Updated: 12 August 2026 | SHA256: 84daf8f33954a0b03238a1e0da3ee109d5bc32acc134cfdddfac36b4b75d2480

Technology
๐Ÿ‡บ๐Ÿ‡ธ United States

Sharecare, Inc.

sharecare.com

This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for you, that is on you. We will b...

Healthcare
๐Ÿ‡บ๐Ÿ‡ธ United States

Carhartt, Inc.

carhartt.com

Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempted to negotiate with us The Co...

Retail & E-Commerce
๐Ÿ‡บ๐Ÿ‡ธ United States

Baxter International, Inc.

baxter.com

Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along with several annoying (digital)...

Healthcare
Unknown

Ali** **********

August 7, 2026 3:00 PM ET: Over 11.5 million records across Salesforce, ServiceNow, and Entra containing some PII of customers and employees and 3.1TB+ of internal corpor...

Technology
๐Ÿ‡ฎ๐Ÿ‡ฑ Israel

Lumenis Ltd.

lumenis.com

Over 1.1 million records containing some Pil of customers/employees and 176GB+ of internal corporate data was compromised. This is a final warning to reach out by 4 A...

Technology
๐Ÿ‡จ๐Ÿ‡ญ Switzerland

Alcon Inc.

alcon.com

Over 25 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 4 August 2026 before we leak along with several annoyin...

Healthcare
๐Ÿ‡ซ๐Ÿ‡ท France

Questel SAS

questel.com

Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. This is a final warning to reach out by 4 August 2026 bef...

๐Ÿ‡บ๐Ÿ‡ธ United States

RingCentral, Inc.

ringcentral.com

Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll come your way....

Technology
๐Ÿ‡บ๐Ÿ‡ธ United States

Ernst & Young

ey.com

Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to release a...

Professional Services
๐Ÿ‡บ๐Ÿ‡ธ United States

Abbott owned Exact Sciences Corporation

You wouldn't want us to describe what was exfiltrated from you publicly. This is a final warning to reach out by 18 July 2026 before we leak along with several annoying (...

Healthcare
๐Ÿ‡บ๐Ÿ‡ธ United States

Fluke Corporation

fluke.com

Over 21 million Salesforce records containing some PII were compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances...

Manufacturing
๐Ÿ‡บ๐Ÿ‡ธ United States

Ingram Content Group, Inc.

ingramcontent.com

The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Updated: 02 July 2026 | SHA256: f...

Business Services
Unknown

Adapt******

Data being leaked by today 12:00 AM New York time. | Updated: 25 June 2026 | Warning: FINAL WARNING PAY OR LEAK

๐Ÿ‡บ๐Ÿ‡ธ United States

icsecurity.com

icsecurity.com

Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoyin...

Technology
๐Ÿ‡บ๐Ÿ‡ธ United States

Amazon owned OneMedical.com

OneMedical.com

Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll come your w...

Healthcare
๐Ÿ‡บ๐Ÿ‡ธ United States

NAIC.org

NAIC.org

Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical platform, Vision credit rating...

Business Services
๐Ÿ‡บ๐Ÿ‡ธ United States

Ralph Lauren

ralphlauren.com

Over 220GB of data containing customer PII, purchase/trasnaction info, future unreleased releases from 2027 and onward, and more was compromised. The Company failed to re...

Consumer Services
๐Ÿ‡บ๐Ÿ‡ธ United States

icc.edu

icc.edu

Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (ICC, SURS pension reporting, W...

Education
๐Ÿ‡บ๐Ÿ‡ธ United States

moody.edu

moody.edu

Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communication...

Education
๐Ÿ‡บ๐Ÿ‡ธ United States

glendale.edu

glendale.edu

Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and admission...

Education
๐Ÿ‡บ๐Ÿ‡ธ United States

hccs.edu

hccs.edu

Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment status, GPA, major, and student ID...

Education
๐Ÿ‡บ๐Ÿ‡ธ United States

kodak.com

kodak.com

Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before we leak al...

Manufacturing
Unknown

Deep Well Services

Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2026 before we leak along with...

Energy