shinyhunters
ransomware group · aka ShinyHunters, UNC5537 (Mandiant/Google Threat Intelligence cluster linked in vendor reporting to the 2024 Snowflake-related campaign), UNC6040 / UNC6052 (Mandiant/Google clusters tied to the 2025 Salesforce social-engineering campaign), linked in public reporting to Scattered Spider (UNC3952) and the broader 'The Com' ecosystem, though the relationship is not formally confirmed · unknown; the name references Pokemon 'shiny hunting'. Press reporting has described individual members (e.g., a French national arrested in 2022 and later prosecuted in the US), but the group's leadership and base of operations are not publicly established. · active since 2020 (first publicly documented database sales and breach claims, per vendor and press reporting)
Victims · 7d
1▼2
Victims · 30d
24active targets
Victims · 90d
34
All-time (tracked)
124since 2026-01-23
Last post
09-13 15:47UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
ShinyHunters is a financially motivated data-theft and extortion group first documented in 2020, known for selling or leaking large stolen databases on underground forums rather than deploying ransomware. Its widely reported track record includes Tokopedia and Wattpad (2020), DoorDash (2023), the Snowflake-related Ticketmaster and AT&T incidents (2024), and a 2025 wave of voice-phishing-driven Salesforce data thefts tied by Mandiant/Google to clusters UNC6040/UNC6052, affecting victims such as Santander, LVMH, Workday, Verizon, Qantas, and Google. The group monetizes through forum sales, data-broker listings, dedicated extortion/leak pages, and direct pressure on victims, and its operations overlap with Scattered Spider and 'The Com' ecosystem. Per this dashboard's leak-site tracking, ShinyHunters posted 3 victims in the last 7 days (a claimed State of Florida DMV breach, a Medela.com listing, and a note addressed to 'databroker1' regarding NEXUS DL Service), with the last post on 2026-09-07; these counts are dashboard-tracked, not lifetime totals. The group's precise membership and country of origin remain unknown.
Tactics & tooling
- Large-scale data exfiltration followed by sale, leak, or extortion, typically without ransomware deployment (data-only extortion)
- Use of credentials harvested by infostealer malware to access cloud data platforms such as Snowflake (reported 2024)
- Voice phishing (vishing) and IT help-desk social engineering to obtain access to victims' Salesforce environments (reported 2025)
- Abuse of OAuth tokens and connected-app integrations (e.g., Salesloft Drift) to mass-access Salesforce tenant data (reported 2025)
- Sale of stolen databases on underground forums and via data-broker channels
- Countdown-style pressure tactics on victims ('data on the clock') via dedicated extortion pages
- Extortion outreach to executives and named individuals at victim organizations
- Collaboration or overlap with Scattered Spider / 'The Com' actors for intrusions and monetization
Targeted sectors
technologye-commerce/retailhospitality/entertainmenttelecomfinancial servicestravel/airlinesluxury goodshealthcare
Notable public victims
Tokopedia (2020), Wattpad (2020), Home Chef (2020), Minted (2020), Zoosk (2020), OkCupid (2020), Teespring (2020), Dave (2020), Mathway (2020), Arcadia Group / Topshop (2020)
Estimated earnings
No public figure.
Leak-site victims124 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Notice | · Jun 11, 2026 | Due to the significant influx of activity going on, we are kindly advising everyone who is being contacted by us to start responding or the inevitable will happen after the deadline. We are not bluffing. Thank you. Make the right decision, don't be the next headline. |
| nottingham.ac.uk | · Jun 9, 2026 | Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the University of Nottingham and its Malaysia and China campuses was compromised, including payer contact information, transaction amounts, IP addresses, full names, home addresses, postcodes, email addresses, phone numbers, dates of birth, and other internal campus data. |
| DentaQuest, LLC. | · May 30, 2026 | The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
| BCD Travel | · May 29, 2026 | Over 700k Salesforce records and various Sharepoint sites corporate data has been compromised. This is a final warning to reach out by 1 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Pay or Leak. |
| DentaQuest, LLC | · May 28, 2026 | You wouldn't want us to describe what data and how much data was compromised. It is in your best interests to reply to us or we are leaking it all by the deadline. This is a final warning to reach out by 29 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Pay or Leak. |
| Baker Distributing Company | · May 23, 2026 | Over 260k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Pay or Leak. |
| Charter Communications, Inc. | · May 23, 2026 | Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Pay or Leak. |
| DentaQuest.com | · May 23, 2026 | You wouldn't want us to describe what data and how much data was compromised. It is in your best interests to reply to us or we are leaking it all by the deadline. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Pay or Leak. |
| PRESS STATEMENT 13/05/2026 | · May 13, 2026 | Due to the public looking for confirmation from us regarding the recent resolution: We have nothing to add on or comment regarding the recent situation at the LMS company. If you are an impacted institution, we are not seeking your money. Please halt all attempts to reach out to us, the matter has been resolved. The Company and it's customers will not further be targeted or contacted for payment. The data is nonexistent. |
| Notification | · May 13, 2026 | The domain shinyhunte.rs was suspended, it is not operated and owned by us anymore. DISCLAIMER: It may be reclaimed by unknown persons in the future for malicious use. We do not control shinyhunte.rs anymore, it has been suspended by the registry. Update, May 12, 13:00 p.m. ET: We will operate at this onion domain only moving forward. Anyone claiming to be us anywhere is impersonating. Our new PGP key is listed in the « Contact us! » button |
| Houghton Mifflin Harcourt Company | · May 9, 2026 | Your data was compromised in several of our campaigns throughout the past few months. We urge you to engage with us, it is in your best interests. This is a final warning to reach out by 12 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| PRESS STATEMENT | · May 8, 2026 | Due to the significant amount of press inquries we are receiving every hour from all around the world, we are making a public statement. We are not commenting and have no further comment to make regarding this global incident. |
| Adelante Soluciones Financieras (Addi.com) | · May 5, 2026 | Over 16M unique persons records containing significant PII, financial/transactions (credit cards), KYC and data from TransUnion and Experian (background checks). The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
| Entire list of affected schools by Instructure breach | · May 5, 2026 | The download button below is a list of affected schools by the Instructure Canvas LMS data breach. If any of the schools in the file are interested in preventing the release of their data please consult with a cyber advisory firm and contact us privately at TOX to negociate a settlement. You have till the end of the day by 7 May 2026 before everything is leaked and there will be no chance at a negociation for anyone. Instructure has not even bothered speaking to us to understand the situation or to even negociate with us to prevent the release of this data. Our demand was not even as high as you might think it is. The Company seemingly does not care about all the students affected and the institutions impacted by this data breach. They still have by 6 May 2026 to come speak with us. There is no better option but to come to an agreement with us. Not paying will only worsen the situation rather than resolving it. |
| Instructure Holdings, Inc. (Canva LMS, instructure.com) | · May 3, 2026 | Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved. Pay or Leak. This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Cushman & Wakefield Inc. | · May 3, 2026 | Over 500k Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| TOWERPOINT WEALTH, LLC | · May 1, 2026 | Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Follett Software LLC | · May 1, 2026 | Over 4M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Vimeo, Inc. | · Apr 28, 2026 | Your Snowflake and Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 30 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Udemy, Inc. (udemy.com) | · Apr 24, 2026 | Over 1.4M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 27 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| ADT, Inc. (adt.com) | · Apr 24, 2026 | Over 10M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 27 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Aman Resorts (aman.com) | · Apr 17, 2026 | Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| The Canada Life Assurance Company (aman.com) | · Apr 17, 2026 | Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| The Canada Life Assurance Company (canadalife.com) | · Apr 17, 2026 | Over 5.6M Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Pitney Bowes Inc. (pb.com) | · Apr 17, 2026 | Over 25M Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| 7-Eleven, Inc. (7-eleven.com) | · Apr 17, 2026 | Over 600k Salesforce records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Carnival Corporation & plc (carnivalcorp.com) | · Apr 17, 2026 | Over 8.7M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Medtronic plc (medtronic.com) | · Apr 17, 2026 | Over 9M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Zara (zara.com) | · Apr 17, 2026 | Your Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Alert 360 Opco Inc. (alert360.com) | · Apr 16, 2026 | Over 2.5M records containing PII and other internal corporate data have been compromised. Please read the chatlog of the negociation by cliking the Download button below to see why this data was leaked. |
| Mytheresa | · Apr 11, 2026 | Sensitive customer PII data and transactional history data was compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Rockstar Games | · Apr 11, 2026 | Your Snowflake instances metrics data was compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Abrigo, Inc. | · Apr 11, 2026 | Over 1.7M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Marcus & Millichap, Inc. | · Apr 11, 2026 | Over 30M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Kemper Corporation | · Apr 11, 2026 | Over 13M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Ryan, LLC. | · Apr 11, 2026 | Over 4.8M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| McGraw Hill, Inc. (mheducation.com) | · Apr 11, 2026 | Over 45M Salesforce records containing PII data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| National Railroad Passenger Corporation (amtrak.com) | · Apr 11, 2026 | Over 9.4M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Cisco Systems, Inc. (cisco.com) | · Apr 1, 2026 | 3 breaches (UNC6040, Salesforce Aura, and AWS accounts). Total over 3M Salesforce records containing PII, Github repositories, AWS buckets and other internal corporate data have been compromised. This is a final warning to reach out by 3 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Hallmark Cards, Inc. & Hallmark Plus | · Mar 30, 2026 | Over 7.9M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 2 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| European Commission (*.europa.eu) | · Mar 28, 2026 | Over 350 GB+ of data was compromised, including data dumps of mail servers, databases, confidential documents, contracts, and much more sensitive material. |
| BreachForums version 5 | · Mar 27, 2026 | BreachForums has been run by many fakes, but by us, following the FBI seizure on 10 Oct 2025. Maintaining such an ecosystem is a waste of our time. There was an unauthorised leak on 9 Jan 2026. Ever since then, false personas going by “N/A“ and “Indra“ were successfully able to restore a similar-looking “legitimate“ forum. All the current forums are fake [ .sb, .ac, .fi, .bf, .us, ect.]. If they continue to exist, we'll leak all the BF backups, including every private message, emails, IP addresses, posts, ect. We have exploits for all 1.8 versions of MyBB. |
| ZenBusiness, Inc. | · Mar 26, 2026 | Several terabytes from Snowflake, Mixpanel, Salesforce, and ect. have been compromised. This is a final warning to reach out by 30 Mar 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Berkadia Commercial Mortgage, LLC. (berkadia.com) | · Mar 25, 2026 | Salesforce records containing PII and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care. |
| Ameriprise Financial, Inc. | · Mar 23, 2026 | Salesforce records containing PII and over 200GB compressed Sharepoint internal corporate data have been compromised. This is a final warning to reach out by 25 Mar 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Infinite Campus, Inc. | · Mar 23, 2026 | Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 25 Mar 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Berkadia Commercial Mortgage LLC | · Mar 20, 2026 | Over 5M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 22 Mar 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| Aura Group, Inc. (aura.com) | · Mar 15, 2026 | Over 900k records containing PII and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care. |
| Aura Group, Inc | · Mar 11, 2026 | Over 2M records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 14 Mar 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
| CFGI Management (cfgi.com) | · Mar 9, 2026 | Over 800k records containing PII and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care about their clients nor investors. |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .