underground-data-leakmass-credential-exposurebreach-disclosure-notificationcybercrime-service-ecosystem

ShinyHunters Data-Extortion Claims Target Crunchbase and Waltio

Breach & Incident Intelligence · 3 sources · Updated 4mo ago · First seen Jan 26, 2026

Crunchbase confirmed a cybersecurity incident after the ShinyHunters cybercrime group claimed it stole over 2 million personal records. ShinyHunters reportedly posted a 402 MB compressed archive online after an extortion attempt failed, and Crunchbase stated the threat actor exfiltrated certain documents from its corporate network. Crunchbase said business operations were not disrupted, the incident was contained, external cybersecurity experts were engaged, and federal law enforcement was notified while the company reviews the exposed data to determine required legal notifications.

In a separate ShinyHunters-linked extortion case, French crypto tax platform Waltio was reported to be facing a ransom threat tied to alleged theft of personal data for nearly 50,000 users, including threatened exposure of users’ 2024 tax reports. Waltio stated its services and production systems remained secure and that no sensitive banking or crypto access data was compromised. The activity aligns with ShinyHunters’ established pattern of data theft and leak-site pressure when ransom demands are not met.

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Dec 1, 2025 – Jan 26, 2026

Jan 26, 20269mo ago
Crunchbase confirms breach and notifies law enforcement
On January 26, 2026, Crunchbase confirmed the breach, said the incident had been contained, and stated that systems were secure and business operations were not disrupted. The company engaged external cybersecurity experts, notified federal law enforcement including the FBI, and began reviewing the exposed data for possible legal notification obligations.
Jan 26, 20269mo ago
ShinyHunters leaks 402 MB archive after failed Crunchbase extortion
After an extortion attempt failed, ShinyHunters reportedly published a 402 MB compressed archive containing more than 2 million Crunchbase records on its leak site. The exposed material was described as including personal data and sensitive corporate files.
Jan 24, 20269mo ago
Waltio faces extortion threat over nearly 50,000 user records
By January 24, 2026, Waltio was reported to be under extortion by ShinyHunters, which claimed to hold personal data for nearly 50,000 users and threatened to leak 2024 tax reports unless paid. Waltio said its production systems remained secure and that no banking or crypto access data was compromised.
Jan 23, 20269mo ago
ShinyHunters posts leaked Crunchbase data on dark web forums
On January 23, 2026, leaked Crunchbase data reportedly appeared on dark web forums. Researcher Alon Gal was cited as independently verifying the authenticity of the exposed data.
Jan 15, 202610mo ago
ShinyHunters exfiltrates data from Crunchbase corporate network
By mid-January 2026, the threat actor had reportedly exfiltrated documents and other data from Crunchbase's corporate network without disrupting public-facing services. Crunchbase later said customer databases were not compromised.
Dec 1, 202511mo ago
ShinyHunters likely gains Crunchbase access via vishing and stolen Okta credentials
The Crunchbase intrusion likely began in December 2025, when attackers used vishing and social engineering against IT staff to steal Okta single sign-on credentials. This access reportedly enabled later movement inside the corporate environment.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

ShinyHunters

Organizations

2 linked

CrunchbaseWaltio

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

CyberthroneNews · Jan 27, 2026

Crunchbase Data Breach: ShinyHunters Exposes 2M+ Records - TheCyberThroneOpen source ↗

Security AffairsNews · Jan 26, 2026

ShinyHunters claims 2 Million Crunchbase records; company confirms breachOpen source ↗

Data Breaches NetNews · Jan 24, 2026

France’s Waltio faces ransom threat from notorious hacker collective - DataBreaches.NetOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

ShinyHunters Data-Extortion Claims Target Crunchbase and Waltio

How this story unfolded

Crunchbase confirms breach and notifies law enforcement

ShinyHunters leaks 402 MB archive after failed Crunchbase extortion

Waltio faces extortion threat over nearly 50,000 user records

ShinyHunters posts leaked Crunchbase data on dark web forums

ShinyHunters exfiltrates data from Crunchbase corporate network

ShinyHunters likely gains Crunchbase access via vishing and stolen Okta credentials

Related entities

Threat actors

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

ShinyHunters Expands Data-Extortion Campaigns Across Sectors

ShinyHunters expands cloud extortion campaign against SaaS, education, and enterprise targets

ShinyHunters Data-Theft and Extortion Targeting CarGurus and Wynn Resorts

ShinyHunters Data-Extortion Claims Target Crunchbase and Waltio

How this story unfolded

Crunchbase confirms breach and notifies law enforcement

ShinyHunters leaks 402 MB archive after failed Crunchbase extortion

Waltio faces extortion threat over nearly 50,000 user records

ShinyHunters posts leaked Crunchbase data on dark web forums

ShinyHunters exfiltrates data from Crunchbase corporate network

ShinyHunters likely gains Crunchbase access via vishing and stolen Okta credentials

Related entities

Threat actors

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

ShinyHunters Expands Data-Extortion Campaigns Across Sectors

ShinyHunters expands cloud extortion campaign against SaaS, education, and enterprise targets

ShinyHunters Data-Theft and Extortion Targeting CarGurus and Wynn Resorts