Loading story…
Hackers from the ShinyHunters group breached Kering, stealing personal data of millions of customers from luxury brands Gucci, Balenciaga, and Alexander McQueen. Exposed data includes names, contact details, addresses, and spending histories, but not financial information. The breach raises significant risks of targeted scams and spear phishing, especially for high-spending customers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcebitdefender.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters has published a broad trove of allegedly stolen data affecting more than 40 organizations across retail, healthcare, hospitality, insurance, and consumer services, with reporting tying the leak campaign to victims including **Bumble**, **Match Group**, **Mytheresa**, **Zara**, **Carnival**, and **7-Eleven**. Researchers said the exposed material includes personally identifiable information, customer and transaction records, internal corporate files, and multi-terabyte datasets; one of the largest alleged exposures involved **Medtronic**, where roughly **9 million records** were reportedly listed before that entry was later removed from the leak site. The campaign reflects ShinyHunters' continued shift from ransomware-style encryption to **data theft and extortion**, with the group allegedly threatening to keep victim data available indefinitely on criminal platforms. Separate reports said the actors claimed to have stolen about **10 million records** from dating-app companies, while researchers also linked leaked **Bumble** data to the same operation after an earlier claim that roughly **30GB** had been taken from the company. The disclosures echo a wider criminal pattern in which stolen sensitive data is leaked to pressure victims after exfiltration, including in healthcare breaches such as the Change Healthcare incident.
Jun 29, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026
ShinyHunters targeted clothing retailer **Carhartt** in a “pay or leak” extortion campaign and published data allegedly taken from the company. The validated portion contains approximately **12.9 million unique email addresses**, alongside names, telephone numbers, and physical addresses; internal and customer-origin indicators support that Carhartt was genuinely breached. The initial claim of 24,876,077 email addresses was substantially overstated because the published dataset included millions of synthetic records from TPC-DS benchmark data in a Databricks environment. Researchers excluded those sample files, as well as duplicate, deactivated, and internal performance-test records, reducing the count to 12,933,413 addresses; the analysis found no evidence that ShinyHunters fabricated the remaining data.
Aug 27, 2026