Loading story…
Jack Henry & Associates disclosed that a vishing social-engineering attack attributed to ShinyHunters compromised a limited portion of its internal, non-production corporate environment. The attackers attempted to extort the company, but Jack Henry said it did not pay; it engaged external forensic specialists and U.S. federal law enforcement to investigate.
Jack Henry said its customer systems, core platforms, operating systems, and daily processing services were not accessed or disrupted, and it reported no service outage. Personally identifiable information tied to fewer than 10 customers was affected; the company notified its more than 7,200 client institutions and offered two years of credit monitoring to affected institutions' account holders.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Jack Henry deployed security protocols to isolate affected systems, engaged an external forensic firm, and cooperated with U.S. federal law enforcement. It notified more than 7,200 client institutions and offered two years of credit monitoring for affected institutions' account holders; it reported fewer than 10 customers' PII was affected and no customer systems or processing services were disrupted.
Jack Henry & Associates disclosed a cybersecurity incident affecting a limited portion of its internal, non-production corporate environment. The company attributed the intrusion to a vishing social-engineering attack by ShinyHunters and said the actor later attempted extortion, which Jack Henry did not pay.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceir.jackhenry.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ADT disclosed that attackers gained unauthorized access to certain cloud-based environments and stole customer and prospective customer data, prompting the company to activate incident response measures, engage forensic specialists, notify law enforcement, and contact affected individuals. The exposed information included names, phone numbers, and home addresses, with dates of birth and the last four digits of Social Security numbers or Tax IDs affected in a smaller number of cases; ADT said payment information was not accessed and customer home security systems were not impacted. The disclosure followed claims by the **ShinyHunters** extortion group that it had stolen more than 10 million records and internal corporate data and would leak the information if its demands were not met. Reporting tied the intrusion to a suspected vishing attack that allegedly compromised an employee's **Okta** single sign-on account and enabled access to ADT's **Salesforce** environment, matching a broader pattern in which the group targets enterprise SSO accounts and connected SaaS platforms to steal data for extortion.
Aug 4, 2026
**Ernst & Young (EY)** is facing a claimed extortion campaign from **ShinyHunters**, which says it stole employee credentials and sensitive files and has threatened to leak the data unless the firm makes contact by **July 31**. A posting attributed to the group warned of both public data exposure and additional digital disruption, while identifying `ey.com` as the affected domain. The claim follows EY's earlier disclosure that attackers gained unauthorized access to a third-party IT service management platform between **March 28 and April 12, 2026**, with anomalous activity detected on **April 23**. EY said documents linked to numerous tax clients were downloaded from support tickets containing tax records and personal and financial data, including names, addresses, Social Security numbers, and payment card details. The firm notified regulators in California and Texas, said at least **1,366** residents across multiple U.S. states were affected, and offered two years of credit monitoring and identity restoration; EY has not confirmed ShinyHunters' involvement, and no leaked data had been observed on underground forums at the time of reporting.
Jul 29, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026