ShinyHunters Impersonators Use Fake Breach Claims to Demand Ransoms

Rival factions and impersonators using the ShinyHunters name are falsely claiming to have breached organizations and demanding ransom payments without compromising their targets, according to Truesec. The report says most original members were arrested in 2025, while disputes among subsequent claimants and the arrest of faction leader Saif Al-Din Khader, known as “Rey,” added to confusion over control of the cybercrime brand. A dispute also exposed the group's private PGP authentication key, undermining its usefulness for verifying affiliation.

The activity reflects a broader extortion tactic in which criminals fabricate compromises or present previously stolen data as evidence of a new breach. Truesec cited the purported ransomware group 0apt, whose more than 70 alleged breaches posted in January 2026 all appeared to be fake. Organizations receiving extortion demands should independently verify whether a compromise occurred, establish the provenance of any supplied data, and avoid treating a recognized criminal name or compromised authentication key as proof of a credible claim.