ShinyHunters — Ransomware Profile
ShinyHunters is a prolific data breach and extortion group since 2020. Breached Ticketmaster (560M records), AT&T (110M via Snowflake), Santander Bank. In 2024 exploited Snowflake misconfigurations to breach 160+ companies. French national sentenced to 3 years in January 2024.Also tracked as
UNC6240
IntelFusions coverage (11)
- Some of August's biggest breach claims were fabricated 2026-09-14 · Cyber Incidents
- ShinyHunters claims 284 million records from McKesson 2026-08-31 · Cyber Incidents
- Drug distribution giant McKesson confirms data theft 2026-08-29 · Cyber Incidents
- Abandoned e-learning platform has 13 flaws and no patch 2026-08-20 · Vulnerabilities
- Extortion crew claims Ernst and Young, RingCentral and Brinks Home 2026-07-29 · Ransomware
- Abbott probes two breaches as extortion gangs claim patient data theft 2026-07-20 · Cyber Incidents
- ShinyHunters leaks data on 2.3 million Moody Bible supporters 2026-07-14 · Cyber Incidents
- Critical Oracle, Kemp, and Linux flaws come under active attack 2026-07-06 · Vulnerabilities
- ShinyHunters claims to hit test gear maker Fluke and distributor Ingram Content 2026-07-02 · Ransomware
- LockBit floods its leak site with 26 victims in two days 2026-06-12 · Ransomware
- ShinyHunters breached universities through an Oracle PeopleSoft zero-day 2026-06-12 · Cyber Incidents
Tools & malware
- Mullvad VPN Tunneling Tool
- Salesforce Data Loader Exfiltration Tool
- ToogleBox Recall Tool
- Tor Tunneling Tool
Recent claimed victims
- Kimberly-Clark 2026-09-13
- State of Florida DMV 2026-09-07
- Medela.com 2026-09-07
- Note to mr. databroker1 NEXUS DL Service 2026-09-04
- Neogen Corporation 2026-08-29
- Elekta AB 2026-08-28
- McKesson Corporation 2026-08-28
- Jack Henry & Associates 2026-08-28
- CyrusOne, LLC. 2026-08-23
- ReliaQuest, LLC 2026-08-23
- NovoCure Limited 2026-08-22
- BOK Financial 2026-08-22
- Logitech/ Streamlabs 2026-08-18
- Metabase 2026-08-14
- Sharecare, Inc. 2026-08-14
- Cook Medical LLC 2026-08-14
- Carhartt, Inc. 2026-08-14
- Baxter International, Inc. 2026-08-14
- Alcon Inc. 2026-08-02
- Lumenis Ltd. 2026-08-02
- Questel SAS 2026-08-02
- Ernst & Young 2026-07-27
- RingCentral, Inc. 2026-07-27
- BH Security, LLC. (brinkshome.com) 2026-07-27
- Abbott owned Exact Sciences Corporation 2026-07-15
Vendor research
- Dark Web Profile: ShinyHunters SOCRadar
- ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications Büyükkaya, A
- ShinyHunters: Cyber Criminal Group Attacks Learning Management System Federal Bureau of Investigation
- Here’s how to guard your enterprise against ShinyHunters Intel 471
- Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware Kelley, M., Vaya, C
- ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit Mandiant, Google Threat Intelligence Group
- a summary of the claims and the company's response Malwarebytes
- Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft Google Threat Intelligence
- The Cost of a Call: From Voice Phishing to Data Extortion Google Threat Intelligence
- the original report Google Threat Intelligence
- Threat Actor Profile: ShinyHunters Analyst1
- ShinyHunters: Cloud Data Extortion Group Mandiant
Countries linked to this actor
- Réunion origin