Loading story…
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets.
The group has also claimed attacks against other cybercriminals: it allegedly exploited CVE-2026-42608, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
Swiss medical-device company Medela was reportedly targeted in a ShinyHunters “pay or leak” extortion campaign.
ShinyHunters reportedly disrupted the Canvas digital-learning platform, affecting more than 8,800 schools nationwide, while pressuring affected organizations to negotiate or risk public release of data.
ShinyHunters reportedly exfiltrated more than one billion records from Salesforce customers and threatened dozens of Fortune 500 victims with publication unless they paid.
ShinyHunters advertised an alleged AT&T database of more than 70 million records, including Social Security numbers and dates of birth, with a $200,000 opening bid and $1 million buyout price. The listing was subsequently removed by forum moderators; ReliaQuest could not verify that the data originated from AT&T.
ShinyHunters publicly revealed an extortion-focused model, claiming it demanded payment from infiltrated victims and threatened data exposure in tactics resembling data-extortion ransomware operations.
ShinyHunters emerged as a financially motivated threat group and posted 91 million allegedly stolen Tokopedia user records for sale on the Empire Market dark-web marketplace.
ShinyHunters defaced the HackForums website and replaced forum material with Pokémon references.
Grav released version 1.7.53.4 to remediate CVE-2026-42608 for users of its 1.7 branch after noting the issue had been fixed in Grav 2.0 but not initially backported to the branch used by Clop.
Clop moved its data-leak site to a new Tor address after the alleged breach and defacement. The group denied any relationship with ShinyHunters and said the compromised server held only site content, not sensitive operational or financial information.
ShinyHunters claimed responsibility for compromising Clop's prior data-leak-site server through CVE-2026-42608, an unauthenticated Grav CMS path-traversal flaw. The group claimed it stole source code, server logs, and private keys before demanding a ransom.
Rockstar Games confirmed that a breach involving a third-party cloud provider exposed a limited amount of non-material company information. ShinyHunters claimed it accessed Rockstar servers managed by that provider and threatened to publish allegedly stolen material unless paid a ransom; Rockstar said the incident did not affect its organization or players.
Data allegedly obtained from Medela was publicly published, exposing approximately 424,000 unique email addresses and primarily corporate contact details; some records included support tickets. The breach was classified as sensitive and not publicly searchable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcehaveibeenpwned.com
Open sourcescworld.com
Open sourcebbc.co.uk
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026
ShinyHunters has published a broad trove of allegedly stolen data affecting more than 40 organizations across retail, healthcare, hospitality, insurance, and consumer services, with reporting tying the leak campaign to victims including **Bumble**, **Match Group**, **Mytheresa**, **Zara**, **Carnival**, and **7-Eleven**. Researchers said the exposed material includes personally identifiable information, customer and transaction records, internal corporate files, and multi-terabyte datasets; one of the largest alleged exposures involved **Medtronic**, where roughly **9 million records** were reportedly listed before that entry was later removed from the leak site. The campaign reflects ShinyHunters' continued shift from ransomware-style encryption to **data theft and extortion**, with the group allegedly threatening to keep victim data available indefinitely on criminal platforms. Separate reports said the actors claimed to have stolen about **10 million records** from dating-app companies, while researchers also linked leaked **Bumble** data to the same operation after an earlier claim that roughly **30GB** had been taken from the company. The disclosures echo a wider criminal pattern in which stolen sensitive data is leaked to pressure victims after exfiltration, including in healthcare breaches such as the Change Healthcare incident.
Jun 29, 2026