Loading story…
Wynn Resorts confirmed that an unauthorized third party stole employee data from its systems following claims by the ShinyHunters cybercrime group. The company said it activated incident response procedures, engaged external cybersecurity experts, and is monitoring for misuse; it also stated it has not seen evidence the data has been published. Wynn indicated the attacker claimed the stolen data was deleted, and the company is offering affected employees free credit monitoring and identity protection; Wynn also said the incident did not impact hotel operations or guest stays.
Reporting noted that Wynn’s entry on the ShinyHunters leak site was subsequently removed, a pattern commonly associated with an extortion payment or negotiated settlement, though Wynn has not confirmed any ransom payment. External commentary highlighted that attacker assurances of “deletion” are not verifiable and may indicate a completed extortion negotiation, and additional reporting indicated lawsuits have already been filed in connection with the breach.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
Wynn Resorts disclosed that the personal information of 21,775 employees was compromised in the breach affecting its internal HR-related systems. The update clarified the scale of the incident while indicating employee data, not customer-facing systems, was impacted.
At least two lawsuits had already been filed against Wynn Resorts in connection with the employee data breach. The filings represented the first reported legal fallout from the incident.
By February 25, 2026, Wynn Resorts’ entry had been removed from the ShinyHunters leak site. Reporting noted this was widely interpreted as a possible sign that an extortion demand had been resolved, though Wynn did not confirm any ransom payment.
Following discovery of the breach, Wynn said it launched an internal investigation, activated incident response protocols, and engaged outside cybersecurity specialists to assist. The company also began offering affected employees free credit monitoring and identity protection services.
Wynn Resorts said an unauthorized third party stole certain employee data from its servers. The company stated the incident did not affect operations or guest stays and that it had not seen evidence of publication or misuse of the data.
Before Wynn’s public confirmation, the ShinyHunters extortion group posted Wynn Resorts on its data leak site, signaling a claim that data had been stolen. The listing brought the incident into public view and prompted wider reporting.
Wynn Resorts disclosed that the theft of employee data occurred during an October breach of its human resources systems. The update established the timeframe of the intrusion behind the incident that was publicly confirmed in February.
ShinyHunters claimed it gained access to Wynn Resorts as early as September 2025, allegedly by exploiting an Oracle PeopleSoft vulnerability and using a staff member’s credentials. This marks the earliest reported point of compromise in the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcedatabreaches.net
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ShinyHunters** is linked to multiple large-scale data-theft and extortion operations, including a breach at automotive marketplace **CarGurus** in February 2026. After an attempted extortion, the stolen CarGurus data was published publicly and reportedly included **12M+ email addresses** across multiple files, with additional exposed information such as names, phone numbers, physical and IP addresses, user account ID mappings, dealer account/subscription details, and auto finance pre-qualification application data (including application outcomes). ShinyHunters also claimed to have stolen **800,000+ records** from **Wynn Resorts** and demanded **22.34 Bitcoin (~$1.5M)** to prevent publication, setting a deadline and threatening further “digital problems” if unpaid. Data samples reviewed by a media outlet reportedly contained employee PII including **Social Security numbers**, names, emails, phone numbers, job details, salaries, start dates, and birthdays; the group alleged initial access occurred in **September 2025** via an **Oracle PeopleSoft vulnerability** combined with an employee’s credentials, and it did not clarify whether the credentials were obtained through social engineering or insider access-for-hire.
Jun 29, 2026
**Ernst & Young (EY)** is facing a claimed extortion campaign from **ShinyHunters**, which says it stole employee credentials and sensitive files and has threatened to leak the data unless the firm makes contact by **July 31**. A posting attributed to the group warned of both public data exposure and additional digital disruption, while identifying `ey.com` as the affected domain. The claim follows EY's earlier disclosure that attackers gained unauthorized access to a third-party IT service management platform between **March 28 and April 12, 2026**, with anomalous activity detected on **April 23**. EY said documents linked to numerous tax clients were downloaded from support tickets containing tax records and personal and financial data, including names, addresses, Social Security numbers, and payment card details. The firm notified regulators in California and Texas, said at least **1,366** residents across multiple U.S. states were affected, and offered two years of credit monitoring and identity restoration; EY has not confirmed ShinyHunters' involvement, and no leaked data had been observed on underground forums at the time of reporting.
Jul 29, 2026
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026