ShinyHunters

November 4, 2026

• Harvard's November 2025 Alumni Affairs and Development breach has been loaded into HIBP with data tied to 851,000 unique email addresses, linked to a ShinyHunters "pay or leak" extortion attempt (BleepingComputer, HIBP). · Nov 4 · observed · Breaches, Leaks & Policy

October 20, 2026

• FBI investigators reportedly suspect that a ransomware negotiator employed by a cybersecurity firm operated a ShinyHunters extortion site. The KrebsOnSecurity report raises a significant conflict-of-interest concern, but the allegation remains an investigative finding rather than an adjudicated fact. KrebsOnSecurity (discussion) · Oct 20 · claimed · Incidents & Cybercrime

October 14, 2026

• The ShinyHunters name is now contested by multiple factions. A new actor calling itself Hasanbr0ker claims leadership after the previous figurehead's arrest, a "ShinyEquationCartel" claims a core drawn from ShinyHunters, LAPSUS$, HellCat and LockBit, and a group using the name is advertising a RaaS programme with an 80/20 split and a $1,000 joining fee. All claims are unverified (Catalin Cimpanu, FalconFeeds). · Oct 14 · claimed · as hasanbr0ker, shiny equation cartel · Threat Activity

Aug 27 – October 11, 2026 · 19 reports

• A third ShinyHunters-linked arrest became public: Canadian cybersecurity executive Edward Dubrovsky was detained in Pennsylvania in connection with alleged extortion activity tied to the FBI's jobs-portal breach investigation. BleepingComputer, The Record (earlier coverage) · Oct 11 · observed · Law Enforcement & Industry
• The FBI arrested the founder of a ransomware negotiation firm over alleged ShinyHunters involvement. Canadian national Edward Dubrovsky was picked up in Pennsylvania on cyber extortion and conspiracy charges, with the main complaint still sealed (KrebsOnSecurity); Director Patel frames him as a co-conspirator in the FBIJobs.gov intrusion on a third-party-managed platform (BleepingComputer), the latest in a run of arrests (earlier coverage). · Oct 10 · observed · Ransomware & Law Enforcement
• The detained ShinyHunters leader was mid-extortion of a Boeing spin-off when arrested. Krebs identifies "Rey" as Saif Al-din Khader of Amman, detained while the group was extorting Jeppesen ForeFlight, and reports he is cooperating with the FBI; the group's access route remains mass exploitation of PeopleSoft flaw CVE-2026-35273, used as a zero-day from June (KrebsOnSecurity). Denmark's CERT notes the FBI has confirmed further arrests in the case (CERT.dk). (earlier coverage) (discussion) · Oct 8 · observed · Arrests & Enforcement
• The FBI removed an Accenture contractor after a missed patch was linked to its employment-portal breach. Reuters says, citing two sources, that the affected third-party platform was Oracle PeopleSoft and ShinyHunters claimed it exploited the system last month. Sensitive data belonging to thousands of FBI employees was exposed, although the bureau has not publicly named either company or platform. · Oct 6 · claimed · via exposed service · Cloud, Identity & Data Exposure
• A core ShinyHunters member using the handle "Rey" is detained in Jordan and cooperating with the FBI, Reuters reports — the second significant arrest in the group's orbit in a week (Reuters, BleepingComputer, earlier coverage). · Oct 4 · none · Threat Activity
• ShinyHunters is publicly defiant after the Amsterdam arrest, claiming it never intended to publish the FBI data and demanding the bureau retract an earlier advisory. Danish CERT notes the arrest happened on 15 September — before the claimed FBI breach — and that investigators seized devices holding data tied to two planned killings abroad (SecurityWeek, CERT.dk) (earlier coverage). · Oct 1 · none · Threat Intelligence
• ShinyHunters' alleged leader arrested in the Netherlands. Dutch police arrested a 24-year-old Amsterdam man on 15 September; the FBI's Cyber Division AD Brett Leatherman publicly called him one of the group's alleged leaders and told remaining members to turn themselves in. A Rotterdam court extended pre-trial detention by at least 90 days on 29 September, and police say further arrests are not ruled out. The FBI puts the group at 140+ organizations breached since last year and at least $70 million in extortion payments, typically via corporate SSO, third-party vendors and SaaS platforms like Salesforce and Snowflake. Dutch police add that material recovered from the suspect's laptop concerns two murders to be committed abroad, with indications he gave the order (BleepingComputer, Politie) (earlier coverage). The group has since put out a statement claiming its operations and infrastructure remain "completely fine" (Dark Web Informer), and CERT.dk notes it has resumed Oracle PeopleSoft CVE-2026-35273 attacks (CERT.dk). · Sep 30 · observed · via phishing email · Threat Activity
• ShinyHunters restarted mass exploitation of Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8), and Mandiant says the group specifically adapted to published defensive guidance, targeting organisations that applied the workarounds but never installed the June 10 patch. Webshells landed on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government; Mandiant urges reviewing database logs for queries against HR, payroll and student-records tables (The Record, The Hacker News). · Sep 29 · observed · Threat Activity
• ShinyHunters (UNC6240) resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273 with a one-character WAF bypass: requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAF and reverse-proxy rules match the literal path before URL decoding while the PeopleSoft app server decodes and routes to the vulnerable servlet — meaning operators who believed their WAF rules mitigated exposure are still reachable. Mandiant/GTIG report web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government, and stress WAF rules are not a substitute for the June out-of-band patch. Hunt for percent-encoded variants in PIA WebLogic access logs and inspect PSEMHUB.war/ for x.jsp, u.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe — the last signed with a valid EV certificate via Sectigo (Google Cloud, BleepingComputer). (earlier coverage) · Sep 27 · observed · as unc6240 · Threat Activity
• ShinyHunters (UNC6240) has resumed mass exploitation of CVE-2026-35273, the unauthenticated RCE in Oracle PeopleSoft PeopleTools (CVSS 9.8, emergency patch 10 June), with a summary of Mandiant/Google Threat Intelligence findings saying the new wave specifically targets organisations that deployed WAF rules as mitigation but never installed the patch — and bypasses those rules trivially (@DarkWebInformer). The group separately told The Register it hacked the FBI to "protect our business" (The Register). · Sep 26 · observed · as unc6240 · Emergency Advisories & Active Exploitation
• Cl0p has moved its leak site to a new onion address and confirmed the old server ran Grav CMS 1.7.43 with an un-updated plugin; BleepingComputer reports the bug used is an unauthenticated path traversal, and Grav's developers confirmed ShinyHunters' technical description was accurate (BleepingComputer). Cl0p denies any relationship with ShinyHunters and disputes that operational or financial data was taken — though it has since been quietly removed from ShinyHunters' leak site (earlier coverage). · Sep 26 · observed · Emergency Advisories & Active Exploitation
• FBI confirms it is investigating the ShinyHunters claim. The group defaced FBIjobs.gov on Tuesday with its Pokémon mascot and posted a leak-site statement demanding the bureau retract a May public service announcement — issued after the Instructure attack — within a week or it will publish data on every agent and applicant. It supplied 5,000 sample agent records to 404 Media and other outlets, which confirmed their legitimacy; the special agent application portal remained offline Wednesday morning. The group claims 2–3 TB via a zero-day and denies swatting, sextortion and membership of The Com (The Record, SecurityWeek) (earlier coverage). · Sep 24 · claimed · Threat Activity
• ShinyHunters says it breached the FBI through an unpatched Oracle PeopleSoft zero-day on the bureau's jobs site, claiming pre-auth RCE, lateral movement onto FBI-managed servers in AWS GovCloud, and 2–3TB of data on current, former and prospective employees — allegedly touching HR, MedLink and CJIS. The group defaced fbijobs.gov, which is now offline "for maintenance," and says it wants no money: it is demanding the FBI retract a 15 May bulletin within a week. The FBI has not confirmed the breach, and neither Oracle nor AWS responded to inquiries (The Register, BleepingComputer). The group also named German dialysis firm Fresenius Medical Care as a victim (@DarkWebInformer); its Cl0p leak-site hijack ran in earlier coverage. · Sep 23 · claimed · Threat Activity & Breaches
• ShinyHunters escalated its extortion of Cl0p: a 21 September message on the hijacked leak site says demands rise every 24 hours without engagement, adds a public apology to the terms, and threatens to publish which companies paid Cl0p, how much, and the receiving Bitcoin addresses — Cl0p replied, and Shiny replied again (earlier coverage). Dark Reading's angle is the one that matters for defenders: organisations that quietly paid may now face renewed extortion from a second crew. The Record, Dark Reading · Sep 22 · observed · as clop · Threat Activity
• ShinyHunters has compromised and defaced the Cl0p leak site, replacing the page behind Cl0p's CAPTCHA with its own Umbreon-branded imagery, per DarkFeed's Ido Cohen (earlier coverage). What's new today is the demand: an updated 20 September message addressed to "Likhogray & Tarasov" demands all proceeds from the Oracle EBS campaign "plus more AND WITH INTEREST," threatening to publish which companies paid, how much, and to which Bitcoin addresses, with 66 hours on the clock (Dark Web Informer). Catalin Cimpanu frames it as ShinyHunters demanding the money Cl0p made from EBS. · Sep 21 · claimed · as cl0p · Threat Activity
• ShinyHunters breached and defaced the Cl0p ransomware gang's Tor leak site, then demanded an eight-figure payment. The intrusion started Friday night via what ShinyHunters claims is an unauthenticated file upload flaw in Grav CMS, used to plant a text file ("Maybe don't try to threaten us next time") on Cl0p's server; hours later the site was replaced with the group's Umbreon ASCII art. ShinyHunters told BleepingComputer it took source code, Grav plugins, everything under /var/log, and the private keys for Cl0p's onion service — which would let it rehost the same .onion address. BleepingComputer confirmed the defacement and the uploaded file but has not verified the data-theft or key claims. BleepingComputer, DarkWebInformer · Sep 20 · attempted · as cl0p · Threat Activity
• ShinyHunters claims a breach of the Florida DMV, using Jeffrey Epstein's driver's licence record as the public proof sample on its pay-or-leak site (vx-underground); Dark Web Informer suggests the licence data may have been bought from the Nexus market actor rather than stolen directly. In the Netherlands, police broadcast the Odido vishing suspect's voice on Opsporing Verzocht on 7 September: a Dutch-speaking man phoned customer service posing as an IT-department colleague and an employee unintentionally granted him access to an internal system, exposing data on more than six million customers. A voice expert concluded it is a real human voice, not AI-generated, and noted the caller's fluent English IT jargon suggests helpdesk experience (Dutch National Police). A ~100 GB Odido dataset is now being distributed publicly rather than sold (Daily Dark Web). · Sep 8 · claimed · via voice call · Threat Activity
• ShinyHunters started publishing data after its extortion deadlines lapsed, marking McKesson (321GB+ compressed), Neogen (313GB+, claimed 5M+ Salesforce records), Swedish medtech Elekta AB and Jack Henry & Associates for download (Daily Dark Web, Dark Web Informer). Separately, Qilin is extorting the US ATF (vx-underground), following ATF's own "major incident" confirmation (earlier coverage). · Sep 4 · observed · as qilin · Threat Activity
• ShinyHunters listed McKesson and Swedish radiotherapy vendor Elekta AB. McKesson has filed an 8-K confirming an incident discovered on 25 August, with the investigation still early and materiality undetermined (BleepingComputer); the Elekta listing carries a 1 September deadline with no stated data volume (Dark Web Informer). · Aug 29 · claimed · Threat Activity

September 29, 2026

• Dutch police confirmed an arrest in the ShinyHunters investigation: a 24-year-old Amsterdam man, named by RTL as Pepijn van der S., detained around 16 September and appearing before the Rotterdam court on 29 September. He was convicted in 2023 of hacking and extortion and released earlier this year. ShinyHunters told RTL the person "has no connection to us" (RTL Nieuws, KrebsOnSecurity). · Sep 29 · none · Threat Activity

September 14, 2026

• Stolen police credentials opened Florida’s DAVID driver database. Florida says attackers used credentials taken from an officer’s personal device, The Record reports. BleepingComputer identifies the compromised account as belonging to a police-department employee with access to the FLHSMV system. ShinyHunters claims more than 2.8 million driver records, but the state’s confirmation establishes the access route, not necessarily the group’s full claimed scope. · Sep 14 · observed · via stolen credentials · as shiny hunters · Identity & Data Exposure

Sep 11 – September 13, 2026 · 2 reports

• Anthropic's 154-page report gains actor-level detail. The Russian state-sponsored cluster it calls GTG-20006 — sharing tradecraft with Midnight Blizzard/APT29 — built an AI-assisted workflow to rebuild malware after detection, in a campaign against more than 20 government, intelligence, diplomatic and defence organisations (The Hacker News, The Record). GTG-50014 (aka MeowSHA), a French-speaking suspected ShinyHunters affiliate, ran 10 AWS EC2 workers that pulled 1.8 million distinct Android APKs, scanned them with TruffleHog and pushed verified secrets to Telegram; a second ShinyHunters affiliate hit SaaS vendors to reach roughly 50 downstream organisations and maintained an autonomous vulnerability-research programme producing working exploits for unknown flaws in network and security appliances (The Hacker News, earlier coverage). Anthropic also describes users in Houthi-held Yemen attempting weapons development, including a failed guided-rocket test, without fielding an operational device (SecurityWeek). Worth reading the caveats: @cyb3rops notes the "sandbox escape" was internet access enabled by a misconfiguration, not a VM or container escape, and the "safety monitor" was another LLM reviewing transcripts after the fact. · Sep 13 · observed · as gtg 20006, midnight blizzard, apt29, gtg 50014, meowsha · AI-Enabled Threat Activity
• Anthropic's September threat intelligence report documents a suspected Russian state-linked group using Claude across phishing, intrusion, data theft and malware development — including rebuilding malware after security products flagged it — against more than 20 organizations, plus ShinyHunters-linked actors running agents to scan 1.8 million Android apps. The framing is that AI is moving from advice into the operational loop: recon, exploitation, credential theft, persistence and victim-data triage (Anthropic). Practitioners are not uniformly sold: @keyth0s argues Anthropic's classifiers are "pretty bad for cyber dual use things" and easy to trip without real evidence (discussion). · Sep 11 · claimed · via phishing email · as shiny hunters · Offensive AI in the Wild

September 12, 2026

• Passkey and SSO-themed phishing is compromising corporate Microsoft 365 accounts. Microsoft links the campaigns to ShinyHunters, Helix, and other extortion crews seeking cloud data, BleepingComputer reports. The activity abuses passwordless-authentication branding through social engineering; it is not a cryptographic break in passkeys. · Sep 12 · observed · via phishing email · as helix · Cloud & Identity

September 11, 2026

• AdaptHealth put the count at 4,115,802 individuals in its HHS filing. Entry was on 5 June through social engineering that compromised a third-party contractor's privileged account; a ransom demand followed on 15 June. ShinyHunters was named by HIPAA Journal, though the company's entry has since vanished from the group's portal (BleepingComputer). · Sep 11 · observed · as shiny hunters · Breaches

September 8, 2026

• Mathspace says 1,079,819 students, staff and parents in Australia and New Zealand had data stolen after attackers exploited a vulnerability in its self-hosted Metabase install to gain administrator access without a login. Access began 10 August, the Australian reporting database was downloaded 27 August, and the theft was confirmed 3 September; no academic records, password hashes, tokens or SSO credentials were exposed (BleepingComputer) — the latest in the run of Metabase SQL injection zero-day intrusions linked to ShinyHunters. · Sep 8 · observed · Breaches

August 27, 2026

• Carhartt's breach affects 12.9 million people — roughly half what ShinyHunters claimed (The Register). · Aug 27 · observed · Breaches, Outages & Policy

Aug 24 – August 25, 2026 · 2 reports

• ReliaQuest confirms a ShinyHunters social-engineering attempt against one of its own employees, with the attacker impersonating a member of its security team; the company says the actor reached a dashboard but data theft failed (BleepingComputer, SecurityWeek). · Aug 25 · attempted · Threat Activity
• ShinyHunters named BOK Financial and CyrusOne, with the CyrusOne listing citing a rejected $13M demand and claiming 12.9 million Salesforce records plus 645 GB of uncompressed SharePoint data, 182,000+ customer rows and 8,300+ rows of employee PII (@DarkWebInformer). The group also claims to have breached security firm ReliaQuest but has published no proof (campuscodi). · Aug 24 · claimed · as shiny hunters · Threat Activity & Cybercrime

Aug 14 – August 16, 2026 · 2 reports

• RingCentral breach data hits Have I Been Pwned — roughly 1.6M unique email addresses, plus names, physical addresses, and phone numbers, were dumped following the July social-engineering intrusion tied to ShinyHunters (earlier coverage). The Register · Aug 16 · observed · via phishing email · Breaches
• RingCentral notified that ShinyHunters stole and published data on 1.6 million accounts (names, addresses, emails, phone numbers) after a July intrusion (BleepingComputer, SecurityWeek, earlier coverage). · Aug 15 · observed · Data Breaches

August 13, 2026

• ShinyHunters leaked data from Sharecare after publicly branding the victim's negotiator "incompetent and unskilled," per Dark Web Informer. · Aug 13 · claimed · Threat Activity

Aug 8 – August 12, 2026

• ShinyHunters is claiming a Metabase hacking spree, with leaked data now surfacing, following the still-uncredentialed unauthenticated SQL-injection zero-day Metabase patched last week (earlier coverage). Metabase urged customers to upgrade immediately (Metabase) (discussion). · Aug 12 · observed · Threat Activity

Aug 8 – August 9, 2026 · 2 reports

• Exact Sciences (owned by Abbott) confirmed a ShinyHunters breach exposing 10.9 million records, including personal and health data, from a July 2026 incident — appearing to give a name to the extortion group's recently advertised multi-million-record haul (Have I Been Pwned) (earlier coverage). · Aug 9 · observed · Threat Activity
• ShinyHunters is advertising 11.5M records from an unnamed victim spanning Salesforce, ServiceNow, and Entra, plus 3.1 TB+ of internal corporate data. @DarkWebInformer · Aug 8 · claimed · Data Breaches

August 2, 2026

• ShinyHunters resurfaces with new infrastructure and fresh victim claims. After announcing a "we're back" statement with new Telegram/X channels and a PGP key, the group has listed several new victims including Questel SAS (claiming 21M Salesforce records / 147 GB) and Lumenis (@DailyDarkWeb). · Aug 2 · claimed · Threat Intelligence

August 1, 2026

• ShinyHunters claims a breach of residential security firm Brinks Home and is threatening to leak stolen data; the group separately announced a "we're back" return with new Telegram, X, and PGP channels (BleepingComputer, The Register). · Aug 1 · claimed · Threat Activity

July 28, 2026

• ShinyHunters claimed the Ernst & Young breach — saying it obtained credentials via a supply-chain attack — as the same group was tied to the DentaQuest breach potentially affecting over 15 million people (BleepingComputer, SecurityWeek). · Jul 28 · claimed · via supply chain · Threat Activity

July 18, 2026

• Abbott investigating two incidents — confirmed unauthorized access to legacy Exact Sciences systems in its Cancer Diagnostics business (claimed by ShinyHunters) plus a separate claim of a breach of its LabCentral portal (BleepingComputer, Abbott statement). · Jul 18 · claimed · Breaches & Extortion

July 15, 2026

• Microsoft mapped a year of ShinyHunters activity against Salesforce, finding attackers walked into corporate tenants without exploiting a single platform flaw — abusing existing OAuth trust between Salesforce and connected apps/third-party vendors, plus vishing and misconfigurations. Defender monitoring was updated in response. The Hacker News, Microsoft · Jul 15 · observed · via voice call · Cloud & Identity

Jul 2 – July 6, 2026 · 4 reports

• Medtronic is notifying nearly 3.8 million individuals after a ShinyHunters data theft exposed personal and medical data; the company says patient safety and operations are unaffected (SecurityAffairs). · Jul 6 · observed · Threat Activity & Intelligence
• Fluke Corporation data tied to ShinyHunters' Salesforce campaign. A forum actor claims 21M+ Salesforce records (100GB+) with PII, attributed to ShinyHunters. Unverified. Daily Dark Web · Jul 5 · claimed · Data Breaches & Threat Intel
• Medtronic breach hits 3.8M people. The medtech firm is notifying patients that ShinyHunters accessed corporate IT systems in April and stole personal and medical data; the company says device safety was unaffected. SecurityWeek · Jul 4 · observed · Threat Intelligence
• Medtronic is notifying customers affected by a ShinyHunters breach; the group also listed Ingram Content Group and Fluke Corporation (previously named by Clop in 2025) on its leak site. BleepingComputer. · Jul 2 · observed · Data Breaches

Jun 28 – June 30, 2026 · 2 reports

• NAIC confirmed a breach by ShinyHunters via an Oracle PeopleSoft zero-day (group claims 3.1 TB stolen); Nissan disclosed an employee-data breach tied to the same PeopleSoft exploitation campaign. NAIC, Nissan · Jun 30 · observed · Threat Activity
• NAIC confirmed a cyberattack exploiting an Oracle PeopleSoft zero-day; ShinyHunters claims 3.1TB of data theft, though the organization disputes the scope. SC Media · Jun 28 · claimed · Breaches & Data Exposure

Jun 17 – June 20, 2026 · 4 reports

• ShinyHunters added more high-profile victims, including the Council of Europe, where it claims a 297GB theft via an Oracle PeopleSoft zero-day. The Register · Jun 20 · claimed · Ransomware & Extortion
• ShinyHunters claims to have published 441,408 internal records (4.7GB) from the Council of Europe, allegedly via an Oracle PeopleSoft zero-day, alongside a fresh batch of high-profile victims (The Register, FalconFeeds). · Jun 19 · claimed · Threat Activity & Intrusions
• Kodak confirmed a data breach claimed by ShinyHunters, working with external responders; scope not yet verified (BleepingComputer, SecurityWeek). · Jun 18 · claimed · Data Breaches (Nordic emphasis)
• ShinyHunters added American Tower, JCPenney, Madison Square Garden Sports, Ralph Lauren, and Nexstar to its leak site (claims unverified), and separately claims a PeopleSoft zero-day heist of ~297GB from the Council of Europe. Kodak and Infinite Campus (137K school staff via Salesforce) also confirmed/were named in ShinyHunters incidents. Daily Dark Web, SecurityWeek, BleepingComputer. · Jun 17 · claimed · Data Breaches & Extortion

June 18, 2026

• Oracle PeopleSoft CVE-2026-35273 unauthenticated RCE is under active exploitation by ShinyHunters (aka Bling Libra), with the education sector hit hardest since at least late May. Horizon3 confirmed exploitation predating disclosure, and Unit 42 corroborates the campaign against universities. watchTowr warns that "vibecoded" PoCs circulating are only the first-stage SSRF, not the full chain — treat public exploits skeptically (watchTowr). · Jun 18 · observed · as bling libra · Vulnerabilities & Exploits

June 17, 2026

• Instructure Canvas breach hit 275 million students: ShinyHunters exploited stored XSS in the support-ticket system, enabled by poor content isolation and shared infrastructure. Scott Helme. · Jun 17 · observed · via exposed service · Data Breaches & Extortion