Loading story…
Houston City College suffered a data breach tied to the ShinyHunters threat group after attackers allegedly stole institutional data and used a "pay or leak" extortion tactic. When the demand was reportedly not met, the data was published publicly and on underground forums, exposing about 832,000 unique email addresses linked to current students and alumni.
The leaked records reportedly included names, home addresses, phone numbers, academic records, and other personal information, creating elevated risks of identity theft, phishing, and long-term privacy harm. The incident adds to a broader pattern of financially motivated attacks against educational institutions, where legacy systems, decentralized IT environments, and limited security budgets can increase exposure to data theft and extortion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
After the extortion demand was reportedly not met, the attackers allegedly published the stolen Houston City College data publicly or on underground forums. The exposed information reportedly included 832,000 unique email addresses along with names, addresses, phone numbers, and academic records.
In June 2026, Houston City College was targeted in a ShinyHunters "pay or leak" extortion campaign in which attackers allegedly obtained data from the college. The incident reportedly affected about 832,000 students and alumni.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ShinyHunters** published datasets it claims were stolen during prior breaches at **Harvard University** and the **University of Pennsylvania (UPenn)**, posting what it says are **over one million records from each university** to its leak site used for extortion. Reporting indicates the exposed information relates to the schools’ development/alumni functions; TechCrunch said it verified portions of the data by corroborating details with alumni and public records (including matching against student ID numbers). Both universities attributed the intrusions to **social engineering** targeting staff supporting alumni and fundraising operations. UPenn previously confirmed unauthorized access to “a select group” of systems tied to development and alumni activities and said attackers also used official university email addresses to message alumni about the incident. Harvard reported its Alumni Affairs and Development environment was accessed following a **phone/voice-phishing** attack, and its incident FAQ described impacted data as including contact details (email, phone, home/business addresses), event attendance, donation details, and other biographical and fundraising-related information; public reporting noted uncertainty about whether affected individuals would receive individual notifications under applicable state requirements.
Jun 29, 2026
ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s **Mariner Society** loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained **8.7 million records** and **7.5 million unique email addresses**, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified. The same group also posted a **"Pay or Leak"** notice claiming it had compromised Udemy and stolen more than **1.4 million user records** along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.
Jun 29, 2026
Glendale Community College disclosed a data breach after it was reportedly targeted in a **ShinyHunters** "pay or leak" extortion campaign, with stolen information later published online. Reporting on the incident says the exposed dataset contained **793,925 compromised accounts** and nearly **800,000 unique email addresses**, making it a large-scale exposure affecting students and other individuals tied to the college. The leaked information reportedly included names, physical addresses, phone numbers, dates of birth, **Social Security numbers**, government-issued identification details, gender, academic records, and student enrollment-related data. The college said the exact data exposed may vary by individual, but the breadth of the breach raises immediate risks of phishing, identity theft, fraud, and account takeover attempts against affected people.
Jul 15, 2026