Loading story…
The ShinyHunters extortion group claimed it breached online learning platform Udemy and stole more than 1.4 million user records, according to multiple reports. The attackers allegedly said the haul includes personally identifiable information and internal corporate files, raising concerns that affected users could face phishing, identity fraud, and other follow-on abuse if the data is authentic.
The group reportedly threatened to publish the stolen information unless Udemy entered negotiations, with reporting indicating a leak deadline of April 27. Researchers and media outlets noted that the exact contents of the dataset had not been independently verified because no sample had been publicly released at the time, but the claim placed Udemy among a growing list of organizations publicly named by ShinyHunters in recent extortion activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The ShinyHunters extortion group claimed it had compromised Udemy and stolen more than 1.4 million records, allegedly including personally identifiable information and internal corporate files. The group reportedly warned that it would publish the data unless Udemy negotiated by April 27.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
linkedin.com
Open sourcepaubox.com
Open sourcecybernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s **Mariner Society** loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained **8.7 million records** and **7.5 million unique email addresses**, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified. The same group also posted a **"Pay or Leak"** notice claiming it had compromised Udemy and stolen more than **1.4 million user records** along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.
Jun 29, 2026
Instructure disclosed a major breach of its **Canvas** learning management system after the **ShinyHunters** group allegedly exploited a vulnerability in the platform’s **Free-For-Teacher** account program on April 30, 2026. The attackers claimed to have stolen data on **275 million individuals**, including student, faculty, and staff information and private messages between students and teachers, with reports estimating about **3.65 TB** of exfiltrated data. The incident was reported to affect thousands of institutions worldwide, with cited impact ranging from **8,809** to roughly **15,000** schools and organizations across the U.S., Europe, and the U.K. After Instructure initially chose to patch systems rather than negotiate, ShinyHunters escalated the campaign by **defacing Canvas login portals** and disrupting final examinations at multiple universities when a ransom deadline approached. Instructure later suspended the Canvas portal during the fallout, and subsequent reporting said the company paid a ransom after receiving digital confirmation that the stolen data had been destroyed and that customers would not face further extortion. The operation was characterized as a **pay-or-leak extortion campaign** that abused account access, application-layer weaknesses, and platform or API functionality rather than deploying malware or encrypting systems.
Jul 7, 2026
ShinyHunters has published a broad trove of allegedly stolen data affecting more than 40 organizations across retail, healthcare, hospitality, insurance, and consumer services, with reporting tying the leak campaign to victims including **Bumble**, **Match Group**, **Mytheresa**, **Zara**, **Carnival**, and **7-Eleven**. Researchers said the exposed material includes personally identifiable information, customer and transaction records, internal corporate files, and multi-terabyte datasets; one of the largest alleged exposures involved **Medtronic**, where roughly **9 million records** were reportedly listed before that entry was later removed from the leak site. The campaign reflects ShinyHunters' continued shift from ransomware-style encryption to **data theft and extortion**, with the group allegedly threatening to keep victim data available indefinitely on criminal platforms. Separate reports said the actors claimed to have stolen about **10 million records** from dating-app companies, while researchers also linked leaked **Bumble** data to the same operation after an earlier claim that roughly **30GB** had been taken from the company. The disclosures echo a wider criminal pattern in which stolen sensitive data is leaked to pressure victims after exfiltration, including in healthcare breaches such as the Change Healthcare incident.
Jun 29, 2026