Threat Group Profile
shinyhunters
● Active — last 30 days
Victim claims
69
First seen
Nov 2023
Last activity
23 Aug 2026
Tracked since
Oct 2025
Group overview
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Preferred targets
Technology · 12
Education · 10
Business Services · 9
Healthcare · 9
Financial Services · 7
Consumer Services · 7
Most targeted countries
US · 51
FR · 2
CH · 2
IL · 2
GB · 1
CO · 1
Tactics & techniques (MITRE ATT&CK)
Initial Access
Unsecured Credentials: Private Keys
Phishing: Spearphishing Voice (Vishing)
Defense Evasion
Use Alternate Authentication Material: Application Access Token
Collection
Data from Information Repositories
Exfiltration
Exfiltration Over Web Service
Impact
Data Encrypted for Impact
Reconnaissance
Phishing for Information: Spearphishing Attachment