Home · Wiki · Entities & Threat Actors

type: entity · created: 2026-08-28 · updated: 2026-09-09 · tags: [cybercrime-group, le-action, campaign, supply-chain, government] · confidence: high · affected_sectors: [technology, healthcare, retail, finance, education, media] · au_impact: true

ShinyHunters

ShinyHunters (leader persona shinycorp; affiliated with The Com) is a black-hat criminal hacker and data-extortion group active since about 2020. It is among the most prolific data-theft and extortion operations in the world, built around large-scale credential theft, SaaS/cloud intrusions and a "pay-or-leak" extortion model rather than bare ransomware encryption. Its name derives from Shiny Pokémon — "shiny hunting" in the Pokémon games. It overlaps heavily with Scattered Spider and cybercrime forums such as The Com.(raw/digests/Cyber-Digest-2026-08-28.md)

TTPs

Large-scale SaaS / cloud data theft from Microsoft 365, SharePoint, OneDrive, Salesforce, Slack, Okta and similar platforms, then exfiltration and extortion.
Vishing and Okta/Entra SSO phishing: impersonated Okta SSO login pages and voice-phishing calls to steal credentials from high-value enterprise users (investment banking, luxury retail, travel, payment processing). 2026 activity tracked by Mandiant/Google Threat Intelligence as UNC6661 / UNC6671.
Supply-chain / integrator pivots: gained access through third-party platforms and integrators — including Anodot → Snowflake — to reach downstream customers (a repeat of the 2024 Snowflake campaign).
Extortion mechanics: demand emails signed "ShinyHunters", follow-on six- to seven-figure ransom demands (BTC), 72-hour deadlines, sample leaks via LimeWire and Tox negotiation, and a ShinyHunters-branded data-leak site on Tor. Uses a delayed extortion model — victims who pay have sometimes had data leaked anyway.
Oracle Access Manager exploitation (CVE-2021-35587) via hard-coded credentials and SQL*Plus data exfiltration.

Notable campaigns and breaches

2020–2021: early sale/leak of hundreds of millions of records (BigBasket ~20M, Tokopedia ~91M, and the 2021 sale of 70M+ AT&T subscriber records — AT&T only acknowledged the breach in 2024).
2024 — Snowflake customer campaign: the campaign that made the group infamous — Ticketmaster (~560M records, $500K asking price), AT&T (~110M call records; AT&T paid ~$370K to delete data), Santander (~30M), Neiman Marcus (~31M), Advance Auto Parts, LendingTree, Bausch Health and others; access via an EPAM Systems supply-chain breach and Snowflake credentials stored unencrypted in Jira.
2025: SoundCloud (~29.8M accounts, Dec 2025), Pornhub (Premium member data threat), and a Salesforce data-leak site extorting 39 victims (Oct 2025).
2026 Okta/Entra SSO campaign: Panera (~5M, Jan), Grubhub, Figure (~1M, Feb), Wynn Resorts (~800K, Feb), Odido (~6M, Feb), Aura (~900K, Mar), Betterment (~1.4M, Feb), Telus/Telus Digital (~1 PB claimed, $65M demand, Mar), European Commission (~350 GB, Mar — attributed by CERT-EU), Rockstar Games (~80M claimed via Anodot→Snowflake, Apr), ADT (~5.5M via Okta vishing, Apr), Carnival Cruise (~6M, Apr), McGraw Hill (~13.5M, Apr), Instructure/Canvas (~275M records/3.65TB, Apr–May — reached a ransom agreement with the group), University of Nottingham (Jun), MSG Sports (45 GB leaked, Jun), RingCentral (~1.6M, Jul).
2026 — Australian-relevant recent incidents: Baxter International (~7.1M alleged Salesforce records, Aug), Carhartt (~12.9M accounts via its Databricks analytics platform, Aug — HIBP-verified), Jack Henry (core-banking/payments vendor; a vishing scheme gained access to an internal non-production environment, Aug — the company refused to pay), and the failed ReliaQuest vishing attack (Aug).
2026 — Government database targeting: Florida FLHSMV "DAVID" driver and vehicle information database, ~200K+ driver records claimed (Sep) via a password-reset flaw that let the group compromise accounts allegedly belonging to DMV employees and an FBI agent, then iterate records by ID. ShinyHunters says it has since lost access (the flaw is being fixed) and warns other states' DMV platforms are being attacked via social engineering — a notable escalation into a state/government revenue and identity registry.

Scale

ShinyHunters has been linked to breaches touching hundreds of millions of records across a wide swathe of sectors — ticketing, telecoms, banking, retail, hospitality, healthcare, education, media and government. It sells stolen datasets (sometimes with ransomware affiliates/other eCrime actors) at prices exceeding US$1M per company.

Attribution and law enforcement

Real-world identity remains largely unknown; researchers describe the name more as a brand than a fixed crew, possibly tied to GnosticPlayers and to Scattered Spider (0ktapus/Muddled Libra/Starfraud). A claimed "Scattered Lapsus$ Hunters" supergroup has been reported.
Arrests have not stopped operations: French national Sébastien Raoult was arrested (May 2022) and extradited to the US over ShinyHunters-linked activity, yet the brand continued shipping breaches. Vercel's April 2026 breach claim was denied by ShinyHunters' actual leadership — a sign the name is now used by copycats.
Group-on-group infiltration (reported, unconfirmed): Krebs reported ShinyHunters "completely hacked" Teampcp ~2 weeks before the 26 Aug 2026 Perth arrests — accessing TeamPCP's internal "Cybercats" Matrix conversations and sharing the data with law enforcement and researchers. See Shinyhunters Infiltrates Teampcp.

Australian angle

ShinyHunters is a direct and repeated threat to Australian and New Zealand organisations and consumers. Health-ISAC has warned of its increasing targeting of healthcare data — directly relevant under APRA CPS 234 and the OAIC Notifiable Data Breaches scheme given AU health sector concentration risk. The Baxter and Carhartt breaches expose AU/NZ retail and health consumers to downstream phishing and fraud; AU/NZ retailers should treat analytics/data platforms (Databricks, Salesforce, Snowflake) holding customer data as a widening target. See also Health Isac Warns Of Increasing Shinyhunters Healthcare Data Theft Attacks.

Scattered Spider — overlapping, collaborating cybercrime group (0ktapus / Muddled Libra)
Shinyhunters Leaks 7 1 Million Records Claimed From Medical Device Maker Baxter — ShinyHunters Baxter International breach (Aug 2026)
Carhartt Breach Shinyhunters Releases Data Of 12 9 Million Accounts — ShinyHunters Carhartt breach (Aug 2026)
Reliaquest Failed Shinyhunters Vishing Attack 2026 08 24 — the failed ReliaQuest vishing attack
Shinyhunters Infiltrates Teampcp — reported infiltration of TeamPCP's Cybercats chat (unconfirmed)