Loading story…
Threat actor ShadowByte$ claimed to have stolen about 859 MB of internal Nintendo data and demanded $2 million to keep it from being released, though Nintendo had not publicly confirmed the incident. Researchers who reviewed leaked samples said parts of the dataset appeared credible, citing employee survey records dating back to 2016, references to current staff, and file metadata reportedly showing creation dates of 2026-01-28.
The exposed material reportedly includes employee names, corporate email addresses, HR surveys, internal analytics, performance and progress-tracking data, exported reports, planning documents, and potentially sensitive financial records such as bank statement PDFs and W-9 forms. Reporting indicates the data may have been obtained through TinyPulse or another third-party HR or SaaS provider rather than through a direct compromise of Nintendo’s core systems, raising risks of phishing, identity theft, and fraud tied to third-party data handling.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Nintendo of America confirmed that data was stolen from TinyPulse, a third-party employee survey service owned by WebMD Health Services, while stating Nintendo’s own systems were not compromised. The company said the exposed data was limited to internal survey content affecting a small subset of employees, was mostly several years old, and did not include customer personal or financial data.
A threat actor using the name ShadowByte$ claimed to have stolen roughly 859 MB of internal Nintendo data spanning about a decade and demanded $2 million to prevent its public release. Reported samples included HR-related records, employee information, surveys, analytics, and planning documents, while Nintendo had not publicly confirmed the incident.
Threat intelligence reporting said SHADOWBYT3$ allegedly exfiltrated about 859 MB of Nintendo-related internal data, but the claim and dataset had not been verified as of June 13, 2026. Reporting also noted a possible link to third-party provider TINYpulse rather than a direct compromise of Nintendo infrastructure.
Researchers reviewing leaked samples said some file metadata showed creation dates of January 28, 2026, which they cited as one indicator that at least part of the dataset may be authentic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcexakep.ru
Open sourcehackread.com
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcetechrepublic.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Figure Technology Solutions**, a blockchain-based lending/fintech firm, confirmed a **data breach** after an employee was **socially engineered**, enabling attackers to access and exfiltrate a **limited number of files**. The company said it is communicating with partners and impacted individuals, has begun sending notifications, and is offering **free credit monitoring** to recipients of breach notices; it has not publicly disclosed the total number of affected individuals or when the incident was detected. The cybercrime group **ShinyHunters** claimed responsibility and alleged Figure refused to pay a ransom, publishing about **2.5GB** of purportedly stolen data on its leak site. Journalists who reviewed samples reported the exposed data included **names, home addresses, dates of birth, and phone numbers**, increasing risk of identity fraud and follow-on phishing. ShinyHunters also told reporters the intrusion was part of a broader campaign affecting organizations including **Harvard University** and **UPenn**, and referenced victims that rely on **Okta** for single sign-on.
Jun 29, 2026
ShinyHunters claimed it breached the Council of Europe and stole roughly **297 GB** of data, saying it exfiltrated more than **429,000 files** from multiple departments and threatening to publish the material unless the organization makes contact by **June 16**. The gang’s leak-site post described a haul spanning the Secretariat, human resources, payroll administration, parliamentary and conference-related units, and said the cache includes payslips, personnel files, CVs, payroll exports, contract records, and performance evaluations affecting more than **10,000 staff**. The allegedly stolen records contain highly sensitive personal data, including names, addresses, dates of birth, salaries, bank details, tax and social security information, and medical or absence records. The Council of Europe said it is investigating the claims and had not confirmed a breach at the time of reporting, while the incident was linked in coverage to ShinyHunters’ broader run of extortion and data-theft operations involving Salesforce-related intrusions, Snowflake customer breaches, and reported exploitation of an Oracle PeopleSoft zero-day.
Jun 29, 2026
Medtronic said an unauthorized party accessed data in portions of its corporate IT environment and that it has contained the incident, activated response procedures, and engaged external cybersecurity experts. The company said it has not identified any impact on **products**, **patient safety**, customer connections, manufacturing and distribution operations, financial reporting systems, or its ability to meet patient needs, stressing that corporate IT, product, manufacturing, and hospital customer networks are segmented. The disclosure followed extortion claims tied to **ShinyHunters**, which said it stole more than **9 million records** containing personally identifiable information along with terabytes of internal corporate data and briefly listed Medtronic on its leak site before the entry disappeared. Medtronic said its investigation is ongoing to determine whether personal data was accessed and that it will notify affected individuals and provide support services if exposure is confirmed, while separate reporting also linked the incident to **Handala**, underscoring uncertainty around attribution even as the breach itself has been confirmed.
Jul 3, 2026