Introduction
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.” ElecticIQ Buyukkaya_ShinyHunters_Sept2025 SOCRadar_ShinyHunters_Mar2024 Unit42KelleyVaya_BlingLibra_Aug2024 Intel471_SH_Aug2021 FBI_SHLMS_May2026 Google_SHOracle_Jun2026 Mandiant_SHDataTheft_Jan2026 Google Salesforce JUN 2025
Activities and Tactics
Country of Origin: 🏳️ [“[Unknown]”]
Notable Campaigns
- 000. Now it is being offered for free on hacker forums.
- 2020-01
- 2020-03
- 2020-05
- 2020-06
- 2020-07
- 2020-11
- 2021-01
- 2021-04
- 2021-05
- 2021-08
- 2021-12
- 2023-06
- 2023-08
- 2024-04
- 2024-05
- 2024-06
- 2024-12
- 2025-01
- 2025-05
- 2025-06
- 2025-07
- 2025-08
- 25 million user records leak online from popular math app Mathway
- 8.3M records for sale
- A hacker claims to have stolen over 500GB of data from Microsoft’s private GitHub repositories
- AT&T denies data breach after hacker auctions 70 million user database
- Adidas Data Breach Linked to Third-Party Vendor
- Advance Auto Parts data breach impacts 2.3 million people
- Air France and KLM disclose data breaches impacting customers
- Allianz Life confirms data breach impacts majority of 1.4 million customers
- An allegedly stolen Wattpad database containing 270 million records were being sold in private sales for over $100
- BleepingComputer has learned.
- Bonobos clothing store suffers a data breach
- BreachForums Resurfaces on Original Dark Web (.onion) Address
- BreachForums Returns Just Weeks After FBI Seizure - Honeypot or Blunder?
- BreachForums Returns Under the Control of ShinyHunters Hackers
- ChatBooks
- Cylance confirms data breach linked to ‘third-party’ platform
- Data of 560 million Ticketmaster customers for sale after alleged breach
- Dior begins sending data breach notifications to U.S. customers
- Fashion giant Chanel hit in wave of Salesforce data theft attacks
- Google suffers data breach in ongoing Salesforce data theft attacks
- Google: Hackers target Salesforce accounts in data extortion attacks
- Hacker leaks 15 million records from Tokopedia
- Hacker leaks 20 million alleged BigBasket user records for free
- Hacker leaks 40 million user records from popular Wishbone app
- Hacker leaks data of 2.28 million dating site users
- Hacker leaks data of millions of Teespring users
- Hacker leaks full database of 77 million Nitro PDF user records
- Hacker posts 1.9 million Pixlr user records for free on forum
- Hackers sell stolen user data from HomeChef
- Havenly discloses data breach after 1.3M accounts leaked online
- Indonesia’s largest online store
- Louis Vuitton says regional data breaches tied to same cyberattack
- Massive AT&T data breach exposes call logs of 109 million customers
- Neiman Marcus data breach: 31 million email addresses found exposed
- Now it’s Tiffany: Another LVMH luxury brand hit by hackers
- Online learning platform Unacademy has suffered a data breach after a hacker gained access to their database and started selling the account information for close to 22 million users.
- Pandora confirms data breach amid ongoing Salesforce data theft attacks
- Pizza Hut Australia customer data hacked
- Popular stock photo service hit by data breach
- PowerSchool hacker now extorting individual school districts
- Promo.com discloses data breach after 22M user records leaked online
- Shifting Strategies: ShinyHunters and Known Cyber Threat Actors Change Tactics
- ShinyHunters claims Santander breach
- ShinyHunters claims to have more than 1 million customers’ information
- ShinyHunters dump partial database of broker firm Upstox
- ShinyHunters hacker leaks 5.22GB worth of Mashable.com database
- ShinyHunters leak database of Indian wedding portal WedMeGood
- Tech unicorn Dave admits to security breach impacting 7.5 million users
- This time
- Updating: Two Telegram channels and two accounts banned
- and BreachForums goes down
- and Chronicle
- hacker leaks 70GB database
- https://databreaches.net/2025/05/26/now-its-tiffany-another-lvmh-luxury-brand-hit-by-hackers/
- https://databreaches.net/2025/08/12/updating-two-telegram-channels-and-two-accounts-banned-one-bounty-offered-and-breachforums-goes-down/
- https://hackread.com/breachforums-resurface-original-dark-web-onion-address/
- https://thehackernews.com/2024/05/breachforums-returns-just-weeks-after.html
- https://www.bleepingcomputer.com/news/security/advance-auto-parts-data-breach-impacts-23-million-people/
- https://www.bleepingcomputer.com/news/security/air-france-and-klm-disclose-data-breaches-impacting-customers/
- https://www.bleepingcomputer.com/news/security/allianz-life-confirms-data-breach-impacts-majority-of-14-million-customers/
- https://www.bleepingcomputer.com/news/security/atandt-confirms-data-for-73-million-customers-leaked-on-hacker-forum/
- https://www.bleepingcomputer.com/news/security/atandt-denies-data-breach-after-hacker-auctions-70-million-user-database/
- https://www.bleepingcomputer.com/news/security/bonobos-clothing-store-suffers-a-data-breach-hacker-leaks-70gb-database/
- https://www.bleepingcomputer.com/news/security/cylance-confirms-data-breach-linked-to-third-party-platform/
- https://www.bleepingcomputer.com/news/security/data-of-560-million-ticketmaster-customers-for-sale-after-alleged-breach/
- https://www.bleepingcomputer.com/news/security/dior-begins-sending-data-breach-notifications-to-us-customers/
- https://www.bleepingcomputer.com/news/security/fashion-giant-chanel-hit-in-wave-of-salesforce-data-theft-attacks/
- https://www.bleepingcomputer.com/news/security/google-hackers-target-salesforce-accounts-in-data-extortion-attacks/
- https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/
- https://www.bleepingcomputer.com/news/security/hacker-leaks-20-million-alleged-bigbasket-user-records-for-free/
- https://www.bleepingcomputer.com/news/security/hacker-leaks-full-database-of-77-million-nitro-pdf-user-records/
- https://www.bleepingcomputer.com/news/security/hacker-posts-19-million-pixlr-user-records-for-free-on-forum/
- https://www.bleepingcomputer.com/news/security/hacker-sells-22-million-unacademy-user-records-after-data-breach/
- https://www.bleepingcomputer.com/news/security/hackers-sell-stolen-user-data-from-homechef-chatbooks-and-chronicle/
- https://www.bleepingcomputer.com/news/security/havenly-discloses-data-breach-after-13m-accounts-leaked-online/
- https://www.bleepingcomputer.com/news/security/louis-vuitton-says-regional-data-breaches-tied-to-same-cyberattack/
- https://www.bleepingcomputer.com/news/security/massive-atandt-data-breach-exposes-call-logs-of-109-million-customers/
- https://www.bleepingcomputer.com/news/security/microsofts-github-account-hacked-private-repositories-stolen/
- https://www.bleepingcomputer.com/news/security/neiman-marcus-data-breach-31-million-email-addresses-found-exposed/
- https://www.bleepingcomputer.com/news/security/pandora-confirms-data-breach-amid-ongoing-salesforce-data-theft-attacks/
- https://www.bleepingcomputer.com/news/security/popular-stock-photo-service-hit-by-data-breach-83m-records-for-sale/
- https://www.bleepingcomputer.com/news/security/powerschool-hacker-now-extorting-individual-school-districts/
- https://www.bleepingcomputer.com/news/security/promocom-discloses-data-breach-after-22m-user-records-leaked-online/
- https://www.bleepingcomputer.com/news/security/shinyhunters-behind-salesforce-data-theft-attacks-at-qantas-allianz-life-and-lvmh/
- https://www.bleepingcomputer.com/news/security/shinyhunters-claims-santander-breach-selling-data-for-30m-customers/
- https://www.bleepingcomputer.com/news/security/wattpad-data-breach-exposes-account-info-for-millions-of-users/
- https://www.databreaches.net/confused-about-the-drama-with-the-new-breachforums-reading-this-will-either-help-you-or-make-your-head-spin/
- https://www.databreaches.net/major-indian-fashion-retailer-hacked-and-data-leaked/
- https://www.databreaches.net/pizza-hut-australia-customer-data-hacked-shinyhunters-claims-to-have-more-than-1-million-customers-information/
- https://www.hackread.com/breachforums-returns-with-shinyhunters-hackers/
- https://www.hackread.com/shinyhunters-broker-firm-upstox-database-leak/
- https://www.hackread.com/shinyhunters-hacker-leaks-mashable-database/
- https://www.hackread.com/shinyhunters-leak-india-wedmegood-database/
- https://www.riskbasedsecurity.com/2021/01/25/shinyhunters-wave-3-one-hacker-exposes-over-125-million-credentials/
- https://www.riskbasedsecurity.com/2021/04/21/shifting-strategies-shinyhunters-and-known-cyber-threat-actors-change-tactics/
- https://www.securityweek.com/adidas-data-breach-linked-to-third-party-vendor/
- https://www.zdnet.com/article/25-million-user-records-leak-online-from-popular-math-app-mathway/
- https://www.zdnet.com/article/hacker-leaks-15-million-records-from-tokopedia-indonesias-largest-online-store/
- https://www.zdnet.com/article/hacker-leaks-data-of-2-28-million-dating-site-users/
- https://www.zdnet.com/article/hacker-leaks-data-of-millions-of-teespring-users/
- https://www.zdnet.com/article/hacker-selling-40-million-user-records-from-popular-wishbone-app/
- https://www.zdnet.com/article/tech-unicorn-dave-admits-to-security-breach-impacting-7-5-million-users/
- one bounty offered
- selling data for 30M customers
- the victim is a Fortune India 500 List company: Mumbai-headquartered Aditya Birla Group (ABG).
Tactics, Techniques, and Procedures (TTPs)
- T1560.002 Archive via Library
- T1550.001 Application Access Token
- T1210 Exploitation of Remote Services
- T1573.002 Asymmetric Cryptography
- T1585.002 Email Accounts
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1190 Exploit Public-Facing Application
- T1530 Data from Cloud Storage
- T1059.007 JavaScript
- T1078 Valid Accounts
- T1567 Exfiltration Over Web Service
- T1598.003 Spearphishing Link
- T1203 Exploitation for Client Execution
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1588.002 Tool
- T1213.003 Code Repositories
- T1684 Social Engineering
- T1552.001 Credentials In Files
- T1078.004 Cloud Accounts
- T1078.002 Domain Accounts
- T1016 System Network Configuration Discovery
- T1491.001 Internal Defacement
- T1036.005 Match Legitimate Resource Name or Location
- T1219 Remote Access Tools
- T1598 Phishing for Information
- T1195.001 Compromise Software Dependencies and Development Tools
- T1657 Financial Theft
- T1580 Cloud Infrastructure Discovery
- T1018 Remote System Discovery
- T1059.009 Cloud API
- T1583.004 Server
- T1072 Software Deployment Tools
- T1588.007 Artificial Intelligence
- T1110 Brute Force
- T1213.006 Databases
- T1589.001 Credentials
- T1593.003 Code Repositories
- T1583.001 Domains
- T1090.003 Multi-hop Proxy
- T1587.004 Exploits
- T1485 Data Destruction
- T1619 Cloud Storage Object Discovery
- T1069.003 Cloud Groups
- T1595.002 Vulnerability Scanning
ATT&CK technique IDs (denormalized)
- T1016
- T1018
- T1036.005
- T1059.007
- T1059.009
- T1069.003
- T1072
- T1078
- T1078.002
- T1078.004
- T1082
- T1083
- T1090.003
- T1105
- T1110
- T1190
- T1195.001
- T1203
- T1210
- T1213.003
- T1213.006
- T1219
- T1485
- T1491.001
- T1528
- T1530
- T1550.001
- T1552.001
- T1560.002
- T1567
- T1573.002
- T1580
- T1583.001
- T1583.004
- T1585.002
- T1587.004
- T1588.002
- T1588.007
- T1589.001
- T1593.003
- T1595.002
- T1598
- T1598.003
- T1619
- T1657
- T1684
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Unknown Logger
- CyberGate
- Cyber Eye RAT
- Xploit
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.
References
[1] mitre-attack [4] ElecticIQ Buyukkaya_ShinyHunters_Sept2025 Büyükkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026. [5] FBI_SHLMS_May2026 Federal Bureau of Investigation. (2026, May 15). ShinyHunters: Cyber Criminal Group Attacks Learning Management System. Retrieved July 1, 2026. [6] Google Salesforce JUN 2025 Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025. [7] Intel471_SH_Aug2021 Intel 471. (2021, August 23). Here’s how to guard your enterprise against ShinyHunters. Retrieved July 29, 2026. [8] Unit42KelleyVaya_BlingLibra_Aug2024 Kelley, M., Vaya, C. (2024, August 23). Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026. [9] Google_SHOracle_Jun2026 Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026. [10] Mandiant_SHDataTheft_Jan2026 Mandiant. (2026, January 30). Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft. Retrieved June 16, 2026. [11] SOCRadar_ShinyHunters_Mar2024 SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.
Recent News
Latest articles from security news feeds mentioning this actor.
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws The Hacker News — 2026-10-28
- Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site KrebsOnSecurity — 2026-10-19 — tags: breach
- Cyber exec arrested in case allegedly tied to ShinyHunters hackers BleepingComputer — 2026-10-10
- FBI arrests another suspected ShinyHunters hacker after agency breach BleepingComputer — 2026-10-09 — tags: breach
- FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach The Hacker News — 2026-10-06 — tags: breach
- ShinyHunters hacker reportedly detained in Jordan, aiding FBI BleepingComputer — 2026-10-03
- Dutch police arrest ShinyHunters hacker accused of planning two murders TechCrunch — 2026-09-29
- Dutch police confirm arrest in ShinyHunters hacking investigation BleepingComputer — 2026-09-28
17 matched articles total. Browse all security news.