Loading story…
Restaurant patrons of businesses using HungerRush reported receiving mass extortion emails sent from spoofed/abused @hungerrush.com addresses, warning that restaurant and customer data could be exposed if the company does not respond. The actor claimed access to “millions” of customer records including names, emails, passwords, addresses, phone numbers, dates of birth, and payment card data. Email header analysis indicated the messages were delivered via Twilio SendGrid infrastructure (including o10.e.hungerrush.com / 159.183.129.119), which recipients said had previously been used for legitimate HungerRush receipt emails—suggesting compromise or misuse of HungerRush-linked email-sending capabilities.
Separately, Pathstone Family Office was alleged to have been breached by the ShinyHunters extortion group, which claimed to have exfiltrated 641,000 records containing PII and internal corporate documents and set a deadline for response before publication. As of reporting, Pathstone had not confirmed an incident and ShinyHunters had not released sample data to substantiate the claim; if validated, exposure could include sensitive client and corporate materials (e.g., legal and estate planning documents, contracts) with downstream risks of fraud, impersonation, and reputational harm.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Header analysis showed the extortion emails were sent through Twilio SendGrid infrastructure and passed SPF, DKIM, and DMARC checks for the hungerrush.com domain. This suggested the sender may have had access to authorized email-sending infrastructure or compromised credentials.
Customers of restaurants using the HungerRush POS platform reported receiving extortion emails threatening exposure of restaurant and customer data unless HungerRush responded. The messages claimed the attacker held records on millions of customers, including sensitive PII and payment card data.
The extortion group said Pathstone had until March 2 to respond before the stolen data would be published. The threatened exposure reportedly included legal and estate planning documents, financial structures, and client contracts if the claim were genuine.
ShinyHunters allegedly listed Pathstone Family Office as a victim and claimed to have exfiltrated 641,000 records containing personally identifiable information and internal corporate documents. No sample data was provided to validate the claim, and Pathstone had not confirmed a breach.
Hudson Rock's Alon Gal said infostealer logs indicate a HungerRush employee device was infected in October 2025, allegedly exposing numerous corporate credentials. The reported compromise was cited as a possible precursor to later extortion activity, though no direct link was confirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grubhub confirmed that unauthorized actors downloaded data from some of its internal systems and that the company is now facing extortion demands. Grubhub said it investigated and stopped the activity and stated that *sensitive information* such as financial data and order history was not impacted; it also engaged a third-party cybersecurity firm and notified law enforcement. Sources cited in reporting attribute the extortion attempt to **ShinyHunters**, with the threat actors allegedly demanding Bitcoin to prevent publication of data. According to sources, the extortion leverages both older **Salesforce** data tied to a February 2025 incident and newer data allegedly taken from **Zendesk**, which Grubhub uses for customer support chat. Reporting also links the intrusion to follow-on activity stemming from the broader **Salesloft Drift**-related credential/OAuth token theft activity, where compromised tokens for Salesloft’s Salesforce integration were used to harvest credentials and secrets for subsequent attacks against downstream services. Separately, Monroe University disclosed a distinct 2024 network breach affecting ~320,000 individuals; it is unrelated to the Grubhub incident and involves theft of extensive personal, financial, and health data.
Jun 29, 2026
A sextortion email campaign is using real email addresses exposed in prior **ShinyHunters-linked** data breaches to make fraudulent threats appear credible and demand **$2,000 in Bitcoin**. The messages claim the sender compromised victims’ devices, installed malware, accessed cameras and microphones, and recorded visits to adult websites, then threaten to release supposed footage unless payment is made within 48 hours. Reporting found **no evidence** that the scammers had actual access to recipients’ devices or accounts. The campaign appears to be run by actors **impersonating ShinyHunters**, not by the extortion group itself, and relies on previously leaked data from breaches affecting organizations including **Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread,** and **McGraw Hill**. Some targeted addresses were confirmed to match leaked datasets, reinforcing the scam’s plausibility, while affected organizations such as Betterment warned customers that the messages are a common extortion attempt and advised recipients not to pay or respond.
Jul 28, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026