Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

ShinyHunters says it breached Council of Europe, stole 300 GB

Part of the ShinyHunters story · since 26 Aug 2025

Quiet for 3 dayslast report 28 Oct202 articles19 outlets
26 Aug · BleepingComputer first10 Jun22 AugNowThis article114th of 202
  • Tue 26 Aug, 21:15 UTC. BleepingComputer, first report. Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks.
  • Sun 14 Sep, 09:10 UTC. Security Affairs, its first report on the story. ShinyHunters Attack National Credit Information Center of Vietnam.
  • Mon 15 Sep, 04:55 UTC. BleepingComputer. FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data.
  • Tue 16 Sep, 13:05 UTC. SecurityWeek, its first report on the story. Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims.
  • Wed 17 Sep, 20:00 UTC. Dark Reading, its first report on the story. 'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree.
  • Wed 17 Sep, 21:40 UTC. DataBreaches, its first report on the story. ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks.
  • Thu 18 Sep, 13:06 UTC. GBHackers, its first report on the story. New ‘shinysp1d3r’ Ransomware-as-a-Service Targets VMware ESXi in Ongoing Development.
  • Fri 19 Sep, 01:45 UTC. SecurityOnline, its first report on the story. ShinyHunters Expands With AI-Powered Vishing, Supply Chain Intrusions, and Insider Recruitment.
  • Fri 19 Sep, 14:50 UTC. SecurityWeek. In Other News: 600k Hit by Healthcare Breaches, Major ShinyHunters Hacks, DeepSeek’s Coding Bias.
  • Sun 21 Sep, 19:20 UTC. DataBreaches. When “Goodbye” isn’t the end: Scattered LAPSUS$ Hunters hack on.
  • Fri 26 Sep, 10:06 UTC. GBHackers. Researchers Map Links Between Major Hacker Groups: LAPSUS$, Scattered Spider, ShinyHunters.
  • Mon 29 Sep, 01:45 UTC. SecurityOnline. Trinity of Chaos: How LAPSUS$, Scattered Spider, and ShinyHunters Forged a Cybercrime Alliance.
  • Tue 30 Sep, 08:25 UTC. Security Affairs. Scattered Spider, ShinyHunters Restructure – New Attacks Underway.
  • Fri 3 Oct, 23:35 UTC. Security Affairs. ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims.
  • Tue 7 Oct, 23:01 UTC. Krebs on Security, its first report on the story. ShinyHunters Wage Broad Corporate Extortion Spree.
  • Mon 13 Oct, 06:45 UTC. GBHackers. Hackers Claim Massive Salesforce Breach: 1 Billion Records Stolen.
  • Thu 16 Oct, 10:56 UTC. DataBreaches. Oracle silently fixes zero-day exploit leaked by ShinyHunters.
  • Fri 17 Oct, 20:15 UTC. DataBreaches. An arrested man’s lawyer claims his client can’t be ShinyHunters’ leader. His argument wasn’t persuasive..
  • Tue 4 Nov, 19:15 UTC. The Hacker News, its first report on the story. A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces.
  • Wed 5 Nov, 02:30 UTC. SecurityOnline. Trustwave Confirms ‘Trinity of Chaos’ Alliance: Scattered LAPSUS$ Hunters Form EaaS Supergroup.
  • Wed 5 Nov, 13:05 UTC. GBHackers. Three Infamous Hacker Groups Join Forces as the ‘Scattered LAPSUS$ Hunters.
  • Fri 14 Nov, 06:01 UTC. GBHackers. Checkout.com Suffers Data Breach as ShinyHunters Attack Cloud Storage.
  • Tue 16 Dec, 09:55 UTC. Security Affairs. Pornhub targeted in extortion attempt following Mixpanel breach exposing user activity.
  • Sat 3 Jan, 19:25 UTC. DataBreaches. ShinyHunters claims to have compromised Resecurity, but it looks like they fell for a honeypot.
  • Sun 4 Jan, 19:10 UTC. Security Affairs. Resecurity Caught ShinyHunters in Honeypot.
  • Fri 23 Jan, 14:06 UTC. DataBreaches. ShinyHunters group opens new dark web leak site, claims responsibility for OKTA vishing campaign.
  • Sat 24 Jan, 12:25 UTC. DataBreaches. ShinyHunters claim to be behind SSO-account data theft attacks.
  • Mon 26 Jan, 16:36 UTC. Security Affairs. ShinyHunters claims 2 Million Crunchbase records; company confirms breach.
  • Tue 27 Jan, 15:10 UTC. SecurityWeek. Over 100 Organizations Targeted in ShinyHunters Phishing Campaign.
  • Fri 30 Jan, 15:15 UTC. Malwarebytes, its first report on the story. Match, Hinge, OkCupid, and Panera Bread breached by ransomware group.
  • Sat 31 Jan, 08:55 UTC. The Hacker News. Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms.
  • Mon 2 Feb, 15:35 UTC. SecurityWeek. ShinyHunters-Branded Extortion Activity Expands, Escalates.
  • Mon 2 Feb, 16:40 UTC. Dark Reading. ShinyHunters Expands Scope of SaaS Extortion Attacks.
  • Wed 4 Feb, 02:10 UTC. SecurityOnline. “IT Support” Imposters: ShinyHunters Vishing Rings Bypass MFA to Steal Data.
  • Mon 16 Feb, 15:50 UTC. Security Affairs. ShinyHunters leaked 600K+ Canada Goose customer records, but the firm denies it was breached.
  • Tue 24 Feb, 14:31 UTC. DataBreaches. Shinyhunters threaten to leak 8M records from Dutch telecom Odido.
  • Wed 25 Feb, 11:40 UTC. SecurityWeek. Wynn confirms ShinyHunters leak group stole 800,000 staff records.
  • Wed 25 Feb, 12:41 UTC. SecurityWeek. Extortion group ShinyHunters leaks 12.5m CarGurus PII.
  • Wed 25 Feb, 12:41 UTC. Security Affairs. ShinyHunters cybercrime group leaks 12.4M CarGurus user records.
  • Wed 25 Feb, 13:51 UTC. DataBreaches. Wynn confirms breach after ShinyHunters deleted data.
  • Sun 1 Mar, 19:53 UTC. Security Affairs. ShinyHunters Exposes Odido Data in Netherlands' Largest Data Leak.
  • Tue 10 Mar, 10:17 UTC. Infosecurity, its first report on the story. ShinyHunters Exploit Salesforce Experience Cloud via Guest Access.
  • Tue 10 Mar, 12:52 UTC. SecurityWeek. ShinyHunters Hit Salesforce Aura Inspector Data Theft.
  • Wed 25 Mar, 12:44 UTC. DataBreaches. Infinite Campus Security Incident Awareness: No Impact to Student Data According to Infinite Campus.
  • Sat 28 Mar, 17:05 UTC. Security Affairs. ShinyHunters claims the hack of the European Commission.
  • Sun 29 Mar, 09:58 UTC. Security Affairs. Security Affairs newsletter Round 569 by Pierluigi Paganini – INTERNATIONAL EDITION.
  • Mon 30 Mar, 11:41 UTC. SecurityWeek. European Commission Reports Cyber Intrusion and Data Theft.
  • Wed 1 Apr, 20:42 UTC. SOCRadar, its first report on the story. Trivy-Linked Cisco Breach & ShinyHunters’ Stolen Data Claim.
  • Fri 3 Apr, 14:11 UTC. SANS ISC, its first report on the story. TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments, (Fri, Apr 3rd). Cites a CVE in CISA KEV.
  • Fri 3 Apr, 16:31 UTC. Dark Reading. TeamPCP supply chain breach hits Mercor and EU Commission clouds.
  • Fri 3 Apr, 22:41 UTC. DataBreaches. Attackers breach EU Commission site via Trivy supply chain attack.
  • Sat 4 Apr, 11:06 UTC. SecurityWeek. European Commission hit by 340GB data breach via AWS Europa hack.
  • Tue 7 Apr, 06:21 UTC. SecurityWeek. Wynn Resorts hit by ShinyHunters breach affecting 21,775 staff.
  • Tue 7 Apr, 11:10 UTC. Malwarebytes. Hims & Hers confirms Zendesk breach exposed support data.
  • Fri 10 Apr, 21:18 UTC. Dark Reading. Hims breach exposes customer support tickets with personal info.
  • Tue 14 Apr, 12:11 UTC. Security Affairs. ShinyHunters leak Rockstar data via third party cloud breach.
  • Mon 20 Apr, 05:00 UTC. The Hacker News. Vercel breach traced to compromised third party AI tool.
  • Mon 20 Apr, 08:41 UTC. SecurityWeek. Vercel breach traced to compromised AI tool, $2M data sale.
  • Tue 21 Apr, 07:01 UTC. SOCRadar. Attackers breached Vercel via compromised Context[.]ai OAuth app.
  • Mon 27 Apr, 20:30 UTC. Security Affairs. Medtronic breach confirmed after ShinyHunters claims 9M records.
  • Tue 28 Apr, 06:50 UTC. SecurityWeek. Medtronic confirms breach after ShinyHunters data leak claim.
  • Tue 28 Apr, 16:10 UTC. Infosecurity. Medtronic investigates breach after ShinyHunters data claim.
  • Tue 28 Apr, 17:20 UTC. SecurityWeek. Vimeo breach hits Anodot, emails exposed by ShinyHunters.
  • Wed 29 Apr, 08:31 UTC. Security Affairs. ShinyHunters exploit Anodot incident to target Vimeo.
  • Mon 4 May, 00:21 UTC. DataBreaches. ShinyHunters strike Instructure again, exposing 275m records.
  • Mon 4 May, 07:08 UTC. SecurityWeek. Instructure breach exposes 275M as ShinyHunters leaks data.
  • Tue 5 May, 08:11 UTC. Security Affairs. Instructure investigating Canvas breach after ShinyHunters claim.
  • Tue 5 May, 19:31 UTC. Security Affairs. Vimeo confirms data breach via Anodot, exposing 119k users.
  • Wed 6 May, 11:51 UTC. DataBreaches. ShinyHunters Leaks 119k Vimeo Users' Emails After April Hack.
  • Wed 6 May, 13:32 UTC. Malwarebytes. Instructure Canvas breach exposes 275 million education records.
  • Wed 6 May, 21:32 UTC. Dark Reading. Instructure Canvas breach leaks data of 275M users.
  • Thu 7 May, 22:51 UTC. DataBreaches. ShinyHunters Hit Instructure Canvas Again, Threaten School Data Leak.
  • Fri 8 May, 10:58 UTC. SecurityWeek. Canvas outage hits schools as hackers threaten data leak.
  • Fri 8 May, 12:40 UTC. Malwarebytes. ShinyHunters hijack Canvas logins, threaten schools with leak.
  • Fri 8 May, 13:11 UTC. DataBreaches. Canvas Restored Sparks Debate Over Paying Ransomware Demands.
  • Fri 8 May, 15:32 UTC. Security Affairs. Zara Data Breach: 197,000 Customers Exposed in Third-Party Security Incident.
  • Fri 8 May, 18:59 UTC. Ars Technica, its first report on the story. Canvas outage hits US school finals, ShinyHunters claims breach.
  • Fri 8 May, 20:40 UTC. Dark Reading. ShinyHunters claims second Canvas breach, 275m records at risk.
  • Mon 11 May, 08:40 UTC. SecurityWeek. Canvas System Is Online After a Cyberattack Disrupted Thousands of Schools.
  • Mon 11 May, 09:19 UTC. Infosecurity. Zara breach leaks 197k records after ShinyHunters attack.
  • Mon 11 May, 10:27 UTC. Infosecurity. ShinyHunters ramps up Canvas breach extortion targeting schools.
  • Mon 11 May, 14:01 UTC. The Hacker News. Ivanti EPMM and PAN OS flaws hit as patches roll out mid May. Cites a CVE in CISA KEV.
  • Tue 12 May, 08:01 UTC. The Hacker News. Instructure reaches deal with ShinyHunters after 9k org breach.
  • Tue 12 May, 09:12 UTC. Malwarebytes. Canvas Data 'Returned' After ShinyHunters Deal, but Risk Remains.
  • Tue 12 May, 13:50 UTC. SecurityWeek. Instructure reaches deal with hackers to delete stolen Canvas data.
  • Tue 12 May, 14:31 UTC. DataBreaches. Homeland Security wants to know about the Instructure breach; we still want to know about the Navigate360 breach.
  • Wed 13 May, 11:32 UTC. Security Affairs. Instructure settles Canvas breach, ShinyHunters return data.
  • Wed 13 May, 12:51 UTC. SecurityWeek. Congress Demands Details on Canvas Cyberattack Affecting Millions.
  • Wed 13 May, 14:49 UTC. Infosecurity. Instructure reaches agreement with ShinyHunters over Canvas breach.
  • Sat 16 May, 17:51 UTC. DataBreaches. Another detail emerges about Instructure’s agreement with ShinyHunters; Debate continues about whether to pay.
  • Mon 18 May, 11:32 UTC. SecurityWeek. ShinyHunters leaks 600k Salesforce records from 7Eleven breach.
  • Mon 18 May, 14:32 UTC. Security Affairs. ShinyHunters says 7 Eleven breach exposed 600k Salesforce records.
  • Tue 26 May, 12:11 UTC. SecurityWeek. ShinyHunters leak 185k 7 Eleven records, data on HaveIBeenPwned.
  • Thu 28 May, 12:17 UTC. Malwarebytes. Carnival breach exposes 6 million after employee account hijacked.
  • Thu 28 May, 14:46 UTC. SecurityWeek. Carnival breach exposes 6 million via social engineering attack.
  • Fri 29 May, 15:28 UTC. SecurityWeek. ShinyHunters claims Charter data leak, HIBP notes 4.9M affected.
  • Sat 30 May, 17:51 UTC. Security Affairs. ShinyHunters leaks 4.9M Charter records after ransom ignored.
  • Sun 31 May, 15:31 UTC. Security Affairs. ShinyHunters Leak 5 Million Charter Communications Records.
  • Fri 5 Jun, 11:55 UTC. SecurityWeek. ShinyHunters Leak Exposes 2.6M DentaQuest Dental Records.
  • Sun 7 Jun, 19:30 UTC. Security Affairs. DentaQuest breach exposes 2.6M patient data after ShinyHunters.
  • Thu 11 Jun, 08:51 UTC. SecurityWeek. University of Nottingham Confirms Breach After Hackers Leak Data.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:50 UTC. Ars Technica. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Sun 14 Jun, 12:20 UTC. DataBreaches. ShinyHunters threatens to leak Council of Europe data.
  • Mon 15 Jun, 10:50 UTC. SecurityWeek. ShinyHunters says it breached Council of Europe, stole 300 GB. This article, 114th of 202.
  • Wed 17 Jun, 10:09 UTC. Security Affairs. EdTech firms hit by ShinyHunters and FulcrumSec cyberattacks.
  • Wed 17 Jun, 12:31 UTC. DataBreaches. Cybercriminals Are Targeting EdTech: Data Breaches and Ransomware Attacks on the Rise.
  • Thu 18 Jun, 07:30 UTC. SecurityWeek. Kodak Confirms Breach After ShinyHunters Steals 2.2M Records.
  • Thu 18 Jun, 10:30 UTC. Malwarebytes. Kodak Confirms ShinyHunters Extortion Breach Affecting 2.2 Million.
  • Fri 19 Jun, 01:10 UTC. DataBreaches. Amazon-owned One Medical Faces ShinyHunters Data Leak Threat.
  • Mon 22 Jun, 10:57 UTC. SecurityWeek. ShinyHunters shift focus to stolen credentials and token abuse.
  • Sat 27 Jun, 12:49 UTC. DataBreaches. NAIC Hit by ShinyHunters Cyber Attack, Leaks 3.1 TB of Data.
  • Mon 29 Jun, 13:50 UTC. SecurityWeek. NAIC PeopleSoft Zero-Day Hack by ShinyHunters, Denies Leak.
  • Tue 30 Jun, 09:32 UTC. SecurityWeek. Nissan Employee Data Breached in Oracle PeopleSoft Hack.
  • Tue 30 Jun, 16:10 UTC. Infosecurity. Nissan employee data exposed via Oracle PeopleSoft zero day flaw.
  • Fri 3 Jul, 10:21 UTC. SecurityWeek. Medtronic Warns 3.8M After ShinyHunters Steals Patient Data.
  • Sun 5 Jul, 19:41 UTC. Security Affairs. Medtronic Breach Hits 3.8M, Tied to ShinyHunters Hackers.
  • Mon 13 Jul, 10:21 UTC. Security Affairs. Dutch police seek local hackers in Odido breach affecting 6M.
  • Mon 13 Jul, 23:31 UTC. Microsoft, its first report on the story. Microsoft Warns ShinyHunters Abuse OAuth to Hit SaaS Firms.
  • Tue 14 Jul, 06:51 UTC. The Hacker News. Microsoft probes Salesforce data theft by ShinyHunters gang.
  • Tue 14 Jul, 19:31 UTC. DataBreaches. Microsoft warns vishing attacks on misconfigured Salesforce access.
  • Sun 19 Jul, 15:51 UTC. DataBreaches. Abbott probes cyberattacks on cancer diagnostics and LabCentral.
  • Mon 20 Jul, 15:30 UTC. Malwarebytes. Abbott probes cyber breach claims as hackers threaten data leak.
  • Mon 27 Jul, 10:08 UTC. SecurityWeek. DentaQuest data breach exposes millions after ShinyHunters leak.
  • Mon 27 Jul, 14:07 UTC. Security Affairs. DentaQuest breach exposes 23 million after ShinyHunters leak.
  • Mon 27 Jul, 15:46 UTC. Malwarebytes. Sextortion Emails Use ShinyHunters Data for Bitcoin Blackmail.
  • Wed 29 Jul, 08:12 UTC. SecurityWeek. ShinyHunters Claims Ernst & Young Hack.
  • Wed 29 Jul, 14:42 UTC. Security Affairs. ShinyHunters threatens to leak EY tax data by July 31.
  • Sun 2 Aug, 14:41 UTC. DataBreaches. Brinks Home breach leaks five million records in extortion bid.
  • Mon 3 Aug, 12:01 UTC. SecurityWeek. ShinyHunters leaks Brinks Home data after ransom refusal.
  • Fri 14 Aug, 08:50 UTC. SecurityWeek. Trezor breach leaks 14,000 customers' data via ShipMonk.
  • Fri 14 Aug, 10:31 UTC. SecurityWeek. RingCentral breach by ShinyHunters exposes 1.6 million records.
  • Sun 23 Aug, 15:41 UTC. DataBreaches. ShinyHunters claim ReliaQuest hack, then delete tweet amid denial.
  • Mon 24 Aug, 12:17 UTC. DataBreaches. ReliaQuest refutes ShinyHunters leak, says fake login was used.
  • Mon 24 Aug, 17:56 UTC. SecurityWeek. ReliaQuest blocks ShinyHunters phishing, confirms no data breach.
  • Tue 25 Aug, 09:40 UTC. Infosecurity. ReliaQuest says breach attempt exposed only view only dashboard.
  • Sat 29 Aug, 01:32 UTC. DataBreaches. McKesson investigates breach after ShinyHunters claim 284M records.
  • Mon 31 Aug, 13:18 UTC. SecurityWeek. McKesson Breach: ShinyHunters Claims 284 Million Records Stolen.
  • Mon 31 Aug, 15:31 UTC. Malwarebytes. McKesson suffers data breach after ShinyHunters voice phishing attack.
  • Tue 1 Sep, 08:56 UTC. Infosecurity. McKesson Probes ShinyHunters Hack Exposing 284 Million Records.
  • Thu 3 Sep, 20:30 UTC. Dark Reading. ReliaQuest Says ShinyHunters Phishing Attack Was Contained.
  • Thu 10 Sep, 14:00 UTC. DataBreaches. McKesson Data Breach Exposes 6.4 Million After ShinyHunters Leak.
  • Sat 19 Sep, 14:25 UTC. DataBreaches. ShinyHunters Claims It Breached and Defaced Clop’s Leak Site. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 11:01 UTC. Malwarebytes. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims.
  • Mon 21 Sep, 12:49 UTC. Infosecurity. ShinyHunters Claims It Hacked and Extorted Clop Ransomware Group. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 15:01 UTC. SOCRadar. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 20:53 UTC. Dark Reading. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 19:11 UTC. DataBreaches. ShinyHunters Claims FBI Breach Exposed Employees’ Private Data.
  • Wed 23 Sep, 07:00 UTC. The Hacker News. ShinyHunters Claims FBI Breach Exposed Agents and Job Applicants.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 10:30 UTC. Infosecurity. ShinyHunters Claims FBI Breach Exploited Oracle PeopleSoft Zero-Day.
  • Wed 23 Sep, 12:49 UTC. Malwarebytes. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 21:50 UTC. Ars Technica. FBI Investigates ShinyHunters Claim of Recruitment Site Breach.
  • Thu 24 Sep, 09:59 UTC. SecurityOnline. ShinyHunters Claims FBI Breach Exploited Oracle PeopleSoft Zero Day.
  • Fri 25 Sep, 15:18 UTC. SecurityWeek. BragJack Lets Malicious Extensions Hijack Browser AI Assistants.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 14:19 UTC. The Hacker News. Attackers Bypass Web Firewalls to Plant Web Shells in PeopleSoft.
  • Mon 28 Sep, 07:30 UTC. Malwarebytes. Malwarebytes Warns of AI Backdoors, ClickFix Traps and Phishing.
  • Mon 28 Sep, 09:47 UTC. Malwarebytes. Alleged FBI Medical Records Leak Exposes Employees’ Private Details.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:35 UTC. Security Affairs. Dutch Police Arrest Alleged ShinyHunters Member in Odido Probe.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 13:14 UTC. DataBreaches. ShinyHunters Claim They Will Not Publish Stolen FBI Personnel Data.
  • Tue 29 Sep, 18:57 UTC. DataBreaches. Dutch Hacker Faces Murder Solicitation Charges in ShinyHunters Probe.
  • Wed 30 Sep, 10:50 UTC. SecurityWeek. FBI Urges ShinyHunters Members to Turn Informant After Arrest.
  • Sat 3 Oct, 16:22 UTC. DataBreaches. ShinyHunters Hacker Detained in Jordan and Reportedly Aids FBI Investigation.
  • Sun 4 Oct, 08:00 UTC. The Hacker News. ShinyHunters Suspect Detained in Jordan and Cooperates With FBI.
  • Sun 4 Oct, 14:57 UTC. Security Affairs. ShinyHunters Suspect Cooperates With FBI to Expose Group Associates.
  • Mon 5 Oct, 07:35 UTC. SecurityWeek. Teen Hacker Arrested After ShinyHunters Claims FBI Data Breach.
  • Mon 5 Oct, 09:57 UTC. SecurityOnline. Jordan Detains ShinyHunters Suspect Said to Be Helping FBI.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 10:42 UTC. Security Affairs. FBI Drops Accenture Contractor After Breach Exposed Staff Data.
  • Tue 6 Oct, 14:27 UTC. SecurityWeek. FBI Removes Accenture Contractor After Employee Data Breach.
  • Wed 7 Oct, 10:50 UTC. Malwarebytes. ShinyHunters Suspect Arrested in Jordan as FBI Tightens the Net.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 17:36 UTC. Dark Reading. Pentagon Data Breach Exposes Records of 3.1 Million People.
  • Fri 9 Oct, 19:24 UTC. The Hacker News. FBI Arrests Suspected ShinyHunters Co-Conspirator in Pennsylvania.
  • Sat 10 Oct, 01:00 UTC. Krebs on Security. FBI arrests ransomware negotiator in ShinyHunters extortion probe.
  • Sat 10 Oct, 12:24 UTC. DataBreaches. FBI Arrests Canadian Man in ShinyHunters Hack Investigation.
  • Mon 12 Oct, 10:22 UTC. Infosecurity. FBI Arrests Canadian Cybersecurity Executive Over ShinyHunters Ties.
  • Mon 12 Oct, 10:58 UTC. SecurityWeek. Cybersecurity Executive Arrested in FBI ShinyHunters Investigation.
  • Mon 12 Oct, 22:36 UTC. Security Affairs. Canadian Ransomware Negotiator Arrested in FBI ShinyHunters Crackdown.
  • Tue 13 Oct, 13:28 UTC. DataBreaches. Experts and Ransomware Groups Weigh In on ShinyHunters’ Future.
  • Thu 15 Oct, 12:49 UTC. DataBreaches. UK Legal Aid Agency Breach Exposed Data Dating Back Before 2007.
  • Fri 16 Oct, 14:26 UTC. Dark Reading. Ransomware Negotiator’s Arrest Exposes Crisis Vendor Vetting Gaps.
  • Mon 19 Oct, 14:00 UTC. Krebs on Security. US Investigators Probe Ransom Negotiators’ Ties to ShinyHunters.
  • Tue 27 Oct, 15:02 UTC. SOCRadar. ShinyHunters claims FBI breach as Clop leak site is hijacked.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:01 UTC. The Hacker News. ShinyHunters exploited three chained flaws in PeopleSoft. Cites a CVE in CISA KEV.

The hacking group ShinyHunters claims to have breached the Council of Europe, exfiltrating nearly 300 GB of sensitive data, including payroll information for over 10,000 employees, along with various personal records. The group threatens to publish this data unless negotiations begin by June 16. The Council has not publicly acknowledged the breach yet.

ShinyHunters has a history of targeting significant organizations, including Salesforce clients and has recently exploited vulnerabilities like a zero-day in Oracle PeopleSoft.

How the story developed

All 202 articles
Quiet for 3 dayslast report 28 Oct202 articles19 outlets

202 articles from 19 outlets since 26 Aug. Quiet since 28 Oct. This was the 114th report, 293 days after the first.

Now26 Aug252115629252419134272419112First reportBleepingComputer · 26 Aug, 21:15This article114th of 202 · day 293Exploited CVESANS ISC · 3 Apr
  • Tue 26 Aug, 21:15 UTC. BleepingComputer, first report. Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks.
  • Sun 14 Sep, 09:10 UTC. Security Affairs, its first report on the story. ShinyHunters Attack National Credit Information Center of Vietnam.
  • Mon 15 Sep, 04:55 UTC. BleepingComputer. FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data.
  • Tue 16 Sep, 13:05 UTC. SecurityWeek, its first report on the story. Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims.
  • Wed 17 Sep, 20:00 UTC. Dark Reading, its first report on the story. 'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree.
  • Wed 17 Sep, 21:40 UTC. DataBreaches, its first report on the story. ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks.
  • Thu 18 Sep, 13:06 UTC. GBHackers, its first report on the story. New ‘shinysp1d3r’ Ransomware-as-a-Service Targets VMware ESXi in Ongoing Development.
  • Fri 19 Sep, 01:45 UTC. SecurityOnline, its first report on the story. ShinyHunters Expands With AI-Powered Vishing, Supply Chain Intrusions, and Insider Recruitment.
  • Fri 19 Sep, 14:50 UTC. SecurityWeek. In Other News: 600k Hit by Healthcare Breaches, Major ShinyHunters Hacks, DeepSeek’s Coding Bias.
  • Sun 21 Sep, 19:20 UTC. DataBreaches. When “Goodbye” isn’t the end: Scattered LAPSUS$ Hunters hack on.
  • Fri 26 Sep, 10:06 UTC. GBHackers. Researchers Map Links Between Major Hacker Groups: LAPSUS$, Scattered Spider, ShinyHunters.
  • Mon 29 Sep, 01:45 UTC. SecurityOnline. Trinity of Chaos: How LAPSUS$, Scattered Spider, and ShinyHunters Forged a Cybercrime Alliance.
  • Tue 30 Sep, 08:25 UTC. Security Affairs. Scattered Spider, ShinyHunters Restructure – New Attacks Underway.
  • Fri 3 Oct, 23:35 UTC. Security Affairs. ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims.
  • Tue 7 Oct, 23:01 UTC. Krebs on Security, its first report on the story. ShinyHunters Wage Broad Corporate Extortion Spree.
  • Mon 13 Oct, 06:45 UTC. GBHackers. Hackers Claim Massive Salesforce Breach: 1 Billion Records Stolen.
  • Thu 16 Oct, 10:56 UTC. DataBreaches. Oracle silently fixes zero-day exploit leaked by ShinyHunters.
  • Fri 17 Oct, 20:15 UTC. DataBreaches. An arrested man’s lawyer claims his client can’t be ShinyHunters’ leader. His argument wasn’t persuasive..
  • Tue 4 Nov, 19:15 UTC. The Hacker News, its first report on the story. A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces.
  • Wed 5 Nov, 02:30 UTC. SecurityOnline. Trustwave Confirms ‘Trinity of Chaos’ Alliance: Scattered LAPSUS$ Hunters Form EaaS Supergroup.
  • Wed 5 Nov, 13:05 UTC. GBHackers. Three Infamous Hacker Groups Join Forces as the ‘Scattered LAPSUS$ Hunters.
  • Fri 14 Nov, 06:01 UTC. GBHackers. Checkout.com Suffers Data Breach as ShinyHunters Attack Cloud Storage.
  • Tue 16 Dec, 09:55 UTC. Security Affairs. Pornhub targeted in extortion attempt following Mixpanel breach exposing user activity.
  • Sat 3 Jan, 19:25 UTC. DataBreaches. ShinyHunters claims to have compromised Resecurity, but it looks like they fell for a honeypot.
  • Sun 4 Jan, 19:10 UTC. Security Affairs. Resecurity Caught ShinyHunters in Honeypot.
  • Fri 23 Jan, 14:06 UTC. DataBreaches. ShinyHunters group opens new dark web leak site, claims responsibility for OKTA vishing campaign.
  • Sat 24 Jan, 12:25 UTC. DataBreaches. ShinyHunters claim to be behind SSO-account data theft attacks.
  • Mon 26 Jan, 16:36 UTC. Security Affairs. ShinyHunters claims 2 Million Crunchbase records; company confirms breach.
  • Tue 27 Jan, 15:10 UTC. SecurityWeek. Over 100 Organizations Targeted in ShinyHunters Phishing Campaign.
  • Fri 30 Jan, 15:15 UTC. Malwarebytes, its first report on the story. Match, Hinge, OkCupid, and Panera Bread breached by ransomware group.
  • Sat 31 Jan, 08:55 UTC. The Hacker News. Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms.
  • Mon 2 Feb, 15:35 UTC. SecurityWeek. ShinyHunters-Branded Extortion Activity Expands, Escalates.
  • Mon 2 Feb, 16:40 UTC. Dark Reading. ShinyHunters Expands Scope of SaaS Extortion Attacks.
  • Wed 4 Feb, 02:10 UTC. SecurityOnline. “IT Support” Imposters: ShinyHunters Vishing Rings Bypass MFA to Steal Data.
  • Mon 16 Feb, 15:50 UTC. Security Affairs. ShinyHunters leaked 600K+ Canada Goose customer records, but the firm denies it was breached.
  • Tue 24 Feb, 14:31 UTC. DataBreaches. Shinyhunters threaten to leak 8M records from Dutch telecom Odido.
  • Wed 25 Feb, 11:40 UTC. SecurityWeek. Wynn confirms ShinyHunters leak group stole 800,000 staff records.
  • Wed 25 Feb, 12:41 UTC. SecurityWeek. Extortion group ShinyHunters leaks 12.5m CarGurus PII.
  • Wed 25 Feb, 12:41 UTC. Security Affairs. ShinyHunters cybercrime group leaks 12.4M CarGurus user records.
  • Wed 25 Feb, 13:51 UTC. DataBreaches. Wynn confirms breach after ShinyHunters deleted data.
  • Sun 1 Mar, 19:53 UTC. Security Affairs. ShinyHunters Exposes Odido Data in Netherlands' Largest Data Leak.
  • Tue 10 Mar, 10:17 UTC. Infosecurity, its first report on the story. ShinyHunters Exploit Salesforce Experience Cloud via Guest Access.
  • Tue 10 Mar, 12:52 UTC. SecurityWeek. ShinyHunters Hit Salesforce Aura Inspector Data Theft.
  • Wed 25 Mar, 12:44 UTC. DataBreaches. Infinite Campus Security Incident Awareness: No Impact to Student Data According to Infinite Campus.
  • Sat 28 Mar, 17:05 UTC. Security Affairs. ShinyHunters claims the hack of the European Commission.
  • Sun 29 Mar, 09:58 UTC. Security Affairs. Security Affairs newsletter Round 569 by Pierluigi Paganini – INTERNATIONAL EDITION.
  • Mon 30 Mar, 11:41 UTC. SecurityWeek. European Commission Reports Cyber Intrusion and Data Theft.
  • Wed 1 Apr, 20:42 UTC. SOCRadar, its first report on the story. Trivy-Linked Cisco Breach & ShinyHunters’ Stolen Data Claim.
  • Fri 3 Apr, 14:11 UTC. SANS ISC, its first report on the story. TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments, (Fri, Apr 3rd). Cites a CVE in CISA KEV.
  • Fri 3 Apr, 16:31 UTC. Dark Reading. TeamPCP supply chain breach hits Mercor and EU Commission clouds.
  • Fri 3 Apr, 22:41 UTC. DataBreaches. Attackers breach EU Commission site via Trivy supply chain attack.
  • Sat 4 Apr, 11:06 UTC. SecurityWeek. European Commission hit by 340GB data breach via AWS Europa hack.
  • Tue 7 Apr, 06:21 UTC. SecurityWeek. Wynn Resorts hit by ShinyHunters breach affecting 21,775 staff.
  • Tue 7 Apr, 11:10 UTC. Malwarebytes. Hims & Hers confirms Zendesk breach exposed support data.
  • Fri 10 Apr, 21:18 UTC. Dark Reading. Hims breach exposes customer support tickets with personal info.
  • Tue 14 Apr, 12:11 UTC. Security Affairs. ShinyHunters leak Rockstar data via third party cloud breach.
  • Mon 20 Apr, 05:00 UTC. The Hacker News. Vercel breach traced to compromised third party AI tool.
  • Mon 20 Apr, 08:41 UTC. SecurityWeek. Vercel breach traced to compromised AI tool, $2M data sale.
  • Tue 21 Apr, 07:01 UTC. SOCRadar. Attackers breached Vercel via compromised Context[.]ai OAuth app.
  • Mon 27 Apr, 20:30 UTC. Security Affairs. Medtronic breach confirmed after ShinyHunters claims 9M records.
  • Tue 28 Apr, 06:50 UTC. SecurityWeek. Medtronic confirms breach after ShinyHunters data leak claim.
  • Tue 28 Apr, 16:10 UTC. Infosecurity. Medtronic investigates breach after ShinyHunters data claim.
  • Tue 28 Apr, 17:20 UTC. SecurityWeek. Vimeo breach hits Anodot, emails exposed by ShinyHunters.
  • Wed 29 Apr, 08:31 UTC. Security Affairs. ShinyHunters exploit Anodot incident to target Vimeo.
  • Mon 4 May, 00:21 UTC. DataBreaches. ShinyHunters strike Instructure again, exposing 275m records.
  • Mon 4 May, 07:08 UTC. SecurityWeek. Instructure breach exposes 275M as ShinyHunters leaks data.
  • Tue 5 May, 08:11 UTC. Security Affairs. Instructure investigating Canvas breach after ShinyHunters claim.
  • Tue 5 May, 19:31 UTC. Security Affairs. Vimeo confirms data breach via Anodot, exposing 119k users.
  • Wed 6 May, 11:51 UTC. DataBreaches. ShinyHunters Leaks 119k Vimeo Users' Emails After April Hack.
  • Wed 6 May, 13:32 UTC. Malwarebytes. Instructure Canvas breach exposes 275 million education records.
  • Wed 6 May, 21:32 UTC. Dark Reading. Instructure Canvas breach leaks data of 275M users.
  • Thu 7 May, 22:51 UTC. DataBreaches. ShinyHunters Hit Instructure Canvas Again, Threaten School Data Leak.
  • Fri 8 May, 10:58 UTC. SecurityWeek. Canvas outage hits schools as hackers threaten data leak.
  • Fri 8 May, 12:40 UTC. Malwarebytes. ShinyHunters hijack Canvas logins, threaten schools with leak.
  • Fri 8 May, 13:11 UTC. DataBreaches. Canvas Restored Sparks Debate Over Paying Ransomware Demands.
  • Fri 8 May, 15:32 UTC. Security Affairs. Zara Data Breach: 197,000 Customers Exposed in Third-Party Security Incident.
  • Fri 8 May, 18:59 UTC. Ars Technica, its first report on the story. Canvas outage hits US school finals, ShinyHunters claims breach.
  • Fri 8 May, 20:40 UTC. Dark Reading. ShinyHunters claims second Canvas breach, 275m records at risk.
  • Mon 11 May, 08:40 UTC. SecurityWeek. Canvas System Is Online After a Cyberattack Disrupted Thousands of Schools.
  • Mon 11 May, 09:19 UTC. Infosecurity. Zara breach leaks 197k records after ShinyHunters attack.
  • Mon 11 May, 10:27 UTC. Infosecurity. ShinyHunters ramps up Canvas breach extortion targeting schools.
  • Mon 11 May, 14:01 UTC. The Hacker News. Ivanti EPMM and PAN OS flaws hit as patches roll out mid May. Cites a CVE in CISA KEV.
  • Tue 12 May, 08:01 UTC. The Hacker News. Instructure reaches deal with ShinyHunters after 9k org breach.
  • Tue 12 May, 09:12 UTC. Malwarebytes. Canvas Data 'Returned' After ShinyHunters Deal, but Risk Remains.
  • Tue 12 May, 13:50 UTC. SecurityWeek. Instructure reaches deal with hackers to delete stolen Canvas data.
  • Tue 12 May, 14:31 UTC. DataBreaches. Homeland Security wants to know about the Instructure breach; we still want to know about the Navigate360 breach.
  • Wed 13 May, 11:32 UTC. Security Affairs. Instructure settles Canvas breach, ShinyHunters return data.
  • Wed 13 May, 12:51 UTC. SecurityWeek. Congress Demands Details on Canvas Cyberattack Affecting Millions.
  • Wed 13 May, 14:49 UTC. Infosecurity. Instructure reaches agreement with ShinyHunters over Canvas breach.
  • Sat 16 May, 17:51 UTC. DataBreaches. Another detail emerges about Instructure’s agreement with ShinyHunters; Debate continues about whether to pay.
  • Mon 18 May, 11:32 UTC. SecurityWeek. ShinyHunters leaks 600k Salesforce records from 7Eleven breach.
  • Mon 18 May, 14:32 UTC. Security Affairs. ShinyHunters says 7 Eleven breach exposed 600k Salesforce records.
  • Tue 26 May, 12:11 UTC. SecurityWeek. ShinyHunters leak 185k 7 Eleven records, data on HaveIBeenPwned.
  • Thu 28 May, 12:17 UTC. Malwarebytes. Carnival breach exposes 6 million after employee account hijacked.
  • Thu 28 May, 14:46 UTC. SecurityWeek. Carnival breach exposes 6 million via social engineering attack.
  • Fri 29 May, 15:28 UTC. SecurityWeek. ShinyHunters claims Charter data leak, HIBP notes 4.9M affected.
  • Sat 30 May, 17:51 UTC. Security Affairs. ShinyHunters leaks 4.9M Charter records after ransom ignored.
  • Sun 31 May, 15:31 UTC. Security Affairs. ShinyHunters Leak 5 Million Charter Communications Records.
  • Fri 5 Jun, 11:55 UTC. SecurityWeek. ShinyHunters Leak Exposes 2.6M DentaQuest Dental Records.
  • Sun 7 Jun, 19:30 UTC. Security Affairs. DentaQuest breach exposes 2.6M patient data after ShinyHunters.
  • Thu 11 Jun, 08:51 UTC. SecurityWeek. University of Nottingham Confirms Breach After Hackers Leak Data.
  • Thu 11 Jun, 14:06 UTC. SecurityWeek. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 20:47 UTC. Google Cloud, its first report on the story. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:20 UTC. The Hacker News. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:01 UTC. SecurityOnline. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-35273. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 06:50 UTC. SecurityWeek. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 11:29 UTC. Security Affairs. CVE-2026-35273 flaw used in ShinyHunters attack on universities. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 14:21 UTC. Rapid7, its first report on the story. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273). Cites a CVE in CISA KEV.
  • Fri 12 Jun, 16:31 UTC. DataBreaches. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:50 UTC. Ars Technica. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 21:01 UTC. Dark Reading. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed. Cites a CVE in CISA KEV.
  • Sat 13 Jun, 09:51 UTC. Security Affairs. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273. Cites a CVE in CISA KEV.
  • Sun 14 Jun, 12:20 UTC. DataBreaches. ShinyHunters threatens to leak Council of Europe data.
  • Mon 15 Jun, 10:50 UTC. SecurityWeek. ShinyHunters says it breached Council of Europe, stole 300 GB. This article, 114th of 202.
  • Wed 17 Jun, 10:09 UTC. Security Affairs. EdTech firms hit by ShinyHunters and FulcrumSec cyberattacks.
  • Wed 17 Jun, 12:31 UTC. DataBreaches. Cybercriminals Are Targeting EdTech: Data Breaches and Ransomware Attacks on the Rise.
  • Thu 18 Jun, 07:30 UTC. SecurityWeek. Kodak Confirms Breach After ShinyHunters Steals 2.2M Records.
  • Thu 18 Jun, 10:30 UTC. Malwarebytes. Kodak Confirms ShinyHunters Extortion Breach Affecting 2.2 Million.
  • Fri 19 Jun, 01:10 UTC. DataBreaches. Amazon-owned One Medical Faces ShinyHunters Data Leak Threat.
  • Mon 22 Jun, 10:57 UTC. SecurityWeek. ShinyHunters shift focus to stolen credentials and token abuse.
  • Sat 27 Jun, 12:49 UTC. DataBreaches. NAIC Hit by ShinyHunters Cyber Attack, Leaks 3.1 TB of Data.
  • Mon 29 Jun, 13:50 UTC. SecurityWeek. NAIC PeopleSoft Zero-Day Hack by ShinyHunters, Denies Leak.
  • Tue 30 Jun, 09:32 UTC. SecurityWeek. Nissan Employee Data Breached in Oracle PeopleSoft Hack.
  • Tue 30 Jun, 16:10 UTC. Infosecurity. Nissan employee data exposed via Oracle PeopleSoft zero day flaw.
  • Fri 3 Jul, 10:21 UTC. SecurityWeek. Medtronic Warns 3.8M After ShinyHunters Steals Patient Data.
  • Sun 5 Jul, 19:41 UTC. Security Affairs. Medtronic Breach Hits 3.8M, Tied to ShinyHunters Hackers.
  • Mon 13 Jul, 10:21 UTC. Security Affairs. Dutch police seek local hackers in Odido breach affecting 6M.
  • Mon 13 Jul, 23:31 UTC. Microsoft, its first report on the story. Microsoft Warns ShinyHunters Abuse OAuth to Hit SaaS Firms.
  • Tue 14 Jul, 06:51 UTC. The Hacker News. Microsoft probes Salesforce data theft by ShinyHunters gang.
  • Tue 14 Jul, 19:31 UTC. DataBreaches. Microsoft warns vishing attacks on misconfigured Salesforce access.
  • Sun 19 Jul, 15:51 UTC. DataBreaches. Abbott probes cyberattacks on cancer diagnostics and LabCentral.
  • Mon 20 Jul, 15:30 UTC. Malwarebytes. Abbott probes cyber breach claims as hackers threaten data leak.
  • Mon 27 Jul, 10:08 UTC. SecurityWeek. DentaQuest data breach exposes millions after ShinyHunters leak.
  • Mon 27 Jul, 14:07 UTC. Security Affairs. DentaQuest breach exposes 23 million after ShinyHunters leak.
  • Mon 27 Jul, 15:46 UTC. Malwarebytes. Sextortion Emails Use ShinyHunters Data for Bitcoin Blackmail.
  • Wed 29 Jul, 08:12 UTC. SecurityWeek. ShinyHunters Claims Ernst & Young Hack.
  • Wed 29 Jul, 14:42 UTC. Security Affairs. ShinyHunters threatens to leak EY tax data by July 31.
  • Sun 2 Aug, 14:41 UTC. DataBreaches. Brinks Home breach leaks five million records in extortion bid.
  • Mon 3 Aug, 12:01 UTC. SecurityWeek. ShinyHunters leaks Brinks Home data after ransom refusal.
  • Fri 14 Aug, 08:50 UTC. SecurityWeek. Trezor breach leaks 14,000 customers' data via ShipMonk.
  • Fri 14 Aug, 10:31 UTC. SecurityWeek. RingCentral breach by ShinyHunters exposes 1.6 million records.
  • Sun 23 Aug, 15:41 UTC. DataBreaches. ShinyHunters claim ReliaQuest hack, then delete tweet amid denial.
  • Mon 24 Aug, 12:17 UTC. DataBreaches. ReliaQuest refutes ShinyHunters leak, says fake login was used.
  • Mon 24 Aug, 17:56 UTC. SecurityWeek. ReliaQuest blocks ShinyHunters phishing, confirms no data breach.
  • Tue 25 Aug, 09:40 UTC. Infosecurity. ReliaQuest says breach attempt exposed only view only dashboard.
  • Sat 29 Aug, 01:32 UTC. DataBreaches. McKesson investigates breach after ShinyHunters claim 284M records.
  • Mon 31 Aug, 13:18 UTC. SecurityWeek. McKesson Breach: ShinyHunters Claims 284 Million Records Stolen.
  • Mon 31 Aug, 15:31 UTC. Malwarebytes. McKesson suffers data breach after ShinyHunters voice phishing attack.
  • Tue 1 Sep, 08:56 UTC. Infosecurity. McKesson Probes ShinyHunters Hack Exposing 284 Million Records.
  • Thu 3 Sep, 20:30 UTC. Dark Reading. ReliaQuest Says ShinyHunters Phishing Attack Was Contained.
  • Thu 10 Sep, 14:00 UTC. DataBreaches. McKesson Data Breach Exposes 6.4 Million After ShinyHunters Leak.
  • Sat 19 Sep, 14:25 UTC. DataBreaches. ShinyHunters Claims It Breached and Defaced Clop’s Leak Site. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 11:01 UTC. Malwarebytes. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims.
  • Mon 21 Sep, 12:49 UTC. Infosecurity. ShinyHunters Claims It Hacked and Extorted Clop Ransomware Group. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 15:01 UTC. SOCRadar. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 20:53 UTC. Dark Reading. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 19:11 UTC. DataBreaches. ShinyHunters Claims FBI Breach Exposed Employees’ Private Data.
  • Wed 23 Sep, 07:00 UTC. The Hacker News. ShinyHunters Claims FBI Breach Exposed Agents and Job Applicants.
  • Wed 23 Sep, 07:36 UTC. SecurityWeek. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 10:30 UTC. Infosecurity. ShinyHunters Claims FBI Breach Exploited Oracle PeopleSoft Zero-Day.
  • Wed 23 Sep, 12:49 UTC. Malwarebytes. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data.
  • Wed 23 Sep, 14:38 UTC. Security Affairs. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 21:50 UTC. Ars Technica. FBI Investigates ShinyHunters Claim of Recruitment Site Breach.
  • Thu 24 Sep, 09:59 UTC. SecurityOnline. ShinyHunters Claims FBI Breach Exploited Oracle PeopleSoft Zero Day.
  • Fri 25 Sep, 15:18 UTC. SecurityWeek. BragJack Lets Malicious Extensions Hijack Browser AI Assistants.
  • Sat 26 Sep, 07:14 UTC. Google Cloud. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 14:19 UTC. The Hacker News. Attackers Bypass Web Firewalls to Plant Web Shells in PeopleSoft.
  • Mon 28 Sep, 07:30 UTC. Malwarebytes. Malwarebytes Warns of AI Backdoors, ClickFix Traps and Phishing.
  • Mon 28 Sep, 09:47 UTC. Malwarebytes. Alleged FBI Medical Records Leak Exposes Employees’ Private Details.
  • Mon 28 Sep, 11:30 UTC. SecurityWeek. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Krebs on Security. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:35 UTC. Security Affairs. Dutch Police Arrest Alleged ShinyHunters Member in Odido Probe.
  • Tue 29 Sep, 10:22 UTC. The Hacker News. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 11:30 UTC. SecurityWeek. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 13:14 UTC. DataBreaches. ShinyHunters Claim They Will Not Publish Stolen FBI Personnel Data.
  • Tue 29 Sep, 18:57 UTC. DataBreaches. Dutch Hacker Faces Murder Solicitation Charges in ShinyHunters Probe.
  • Wed 30 Sep, 10:50 UTC. SecurityWeek. FBI Urges ShinyHunters Members to Turn Informant After Arrest.
  • Sat 3 Oct, 16:22 UTC. DataBreaches. ShinyHunters Hacker Detained in Jordan and Reportedly Aids FBI Investigation.
  • Sun 4 Oct, 08:00 UTC. The Hacker News. ShinyHunters Suspect Detained in Jordan and Cooperates With FBI.
  • Sun 4 Oct, 14:57 UTC. Security Affairs. ShinyHunters Suspect Cooperates With FBI to Expose Group Associates.
  • Mon 5 Oct, 07:35 UTC. SecurityWeek. Teen Hacker Arrested After ShinyHunters Claims FBI Data Breach.
  • Mon 5 Oct, 09:57 UTC. SecurityOnline. Jordan Detains ShinyHunters Suspect Said to Be Helping FBI.
  • Tue 6 Oct, 07:46 UTC. The Hacker News. FBI removes Accenture contractor after ShinyHunters breach exposes staff data. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 10:42 UTC. Security Affairs. FBI Drops Accenture Contractor After Breach Exposed Staff Data.
  • Tue 6 Oct, 14:27 UTC. SecurityWeek. FBI Removes Accenture Contractor After Employee Data Breach.
  • Wed 7 Oct, 10:50 UTC. Malwarebytes. ShinyHunters Suspect Arrested in Jordan as FBI Tightens the Net.
  • Wed 7 Oct, 14:31 UTC. Krebs on Security. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 17:36 UTC. Dark Reading. Pentagon Data Breach Exposes Records of 3.1 Million People.
  • Fri 9 Oct, 19:24 UTC. The Hacker News. FBI Arrests Suspected ShinyHunters Co-Conspirator in Pennsylvania.
  • Sat 10 Oct, 01:00 UTC. Krebs on Security. FBI arrests ransomware negotiator in ShinyHunters extortion probe.
  • Sat 10 Oct, 12:24 UTC. DataBreaches. FBI Arrests Canadian Man in ShinyHunters Hack Investigation.
  • Mon 12 Oct, 10:22 UTC. Infosecurity. FBI Arrests Canadian Cybersecurity Executive Over ShinyHunters Ties.
  • Mon 12 Oct, 10:58 UTC. SecurityWeek. Cybersecurity Executive Arrested in FBI ShinyHunters Investigation.
  • Mon 12 Oct, 22:36 UTC. Security Affairs. Canadian Ransomware Negotiator Arrested in FBI ShinyHunters Crackdown.
  • Tue 13 Oct, 13:28 UTC. DataBreaches. Experts and Ransomware Groups Weigh In on ShinyHunters’ Future.
  • Thu 15 Oct, 12:49 UTC. DataBreaches. UK Legal Aid Agency Breach Exposed Data Dating Back Before 2007.
  • Fri 16 Oct, 14:26 UTC. Dark Reading. Ransomware Negotiator’s Arrest Exposes Crisis Vendor Vetting Gaps.
  • Mon 19 Oct, 14:00 UTC. Krebs on Security. US Investigators Probe Ransom Negotiators’ Ties to ShinyHunters.
  • Tue 27 Oct, 15:02 UTC. SOCRadar. ShinyHunters claims FBI breach as Clop leak site is hijacked.
  • Tue 27 Oct, 19:05 UTC. thezdi.com, its first report on the story. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:01 UTC. The Hacker News. ShinyHunters exploited three chained flaws in PeopleSoft. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 202 articles as a list
  1. Tue 26 AugDay 01
    1. Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks21:15 · BleepingComputer · First report

  2. Quiet for 3 weeks

    Sun 14 SepDay 191
    1. ShinyHunters Attack National Credit Information Center of Vietnam09:10 · Security Affairs · Picked up again
  3. Mon 15 SepDay 201
    1. FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data04:55 · BleepingComputer
  4. Tue 16 SepDay 211
    1. Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims13:05 · SecurityWeek
  5. Wed 17 SepDay 222
    1. 'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree20:00 · Dark Reading
    2. ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks21:40 · DataBreaches
  6. Thu 18 SepDay 231
    1. New ‘shinysp1d3r’ Ransomware-as-a-Service Targets VMware ESXi in Ongoing Development13:06 · GBHackers
  7. Fri 19 SepDay 242
    1. ShinyHunters Expands With AI-Powered Vishing, Supply Chain Intrusions, and Insider Recruitment01:45 · SecurityOnline
    2. In Other News: 600k Hit by Healthcare Breaches, Major ShinyHunters Hacks, DeepSeek’s Coding Bias14:50 · SecurityWeek

  8. Quiet for 2 days

    Sun 21 SepDay 261
    1. When “Goodbye” isn’t the end: Scattered LAPSUS$ Hunters hack on19:20 · DataBreaches · Picked up again

  9. Quiet for 5 days

    Fri 26 SepDay 311
    1. Researchers Map Links Between Major Hacker Groups: LAPSUS$, Scattered Spider, ShinyHunters10:06 · GBHackers · Picked up again

  10. Quiet for 3 days

    Mon 29 SepDay 341
    1. Trinity of Chaos: How LAPSUS$, Scattered Spider, and ShinyHunters Forged a Cybercrime Alliance01:45 · SecurityOnline · Picked up again
  11. Tue 30 SepDay 351
    1. Scattered Spider, ShinyHunters Restructure – New Attacks Underway08:25 · Security Affairs

  12. Quiet for 4 days

    Fri 3 OctDay 381
    1. ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims23:35 · Security Affairs · Picked up again

  13. Quiet for 4 days

    Tue 7 OctDay 421
    1. ShinyHunters Wage Broad Corporate Extortion Spree23:01 · Krebs on Security · Picked up again

  14. Quiet for 5 days

    Mon 13 OctDay 481
    1. Hackers Claim Massive Salesforce Breach: 1 Billion Records Stolen06:45 · GBHackers · Picked up again

  15. Quiet for 3 days

    Thu 16 OctDay 511
    1. Oracle silently fixes zero-day exploit leaked by ShinyHunters10:56 · DataBreaches · Picked up again
  16. Fri 17 OctDay 521
    1. An arrested man’s lawyer claims his client can’t be ShinyHunters’ leader. His argument wasn’t persuasive.20:15 · DataBreaches

  17. Quiet for 3 weeks

    Tue 4 NovDay 701
    1. A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces19:15 · The Hacker News · Picked up again
  18. Wed 5 NovDay 712
    1. Trustwave Confirms ‘Trinity of Chaos’ Alliance: Scattered LAPSUS$ Hunters Form EaaS Supergroup02:30 · SecurityOnline
    2. Three Infamous Hacker Groups Join Forces as the ‘Scattered LAPSUS$ Hunters13:05 · GBHackers

  19. Quiet for 9 days

    Fri 14 NovDay 801
    1. Checkout.com Suffers Data Breach as ShinyHunters Attack Cloud Storage06:01 · GBHackers · Picked up again

  20. Quiet for 5 weeks

    Tue 16 DecDay 1121
    1. Pornhub targeted in extortion attempt following Mixpanel breach exposing user activity09:55 · Security Affairs · Picked up again

  21. Quiet for 3 weeks

    Sat 3 JanDay 1301
    1. ShinyHunters claims to have compromised Resecurity, but it looks like they fell for a honeypot19:25 · DataBreaches · Picked up again
  22. Sun 4 JanDay 1311
    1. Resecurity Caught ShinyHunters in Honeypot19:10 · Security Affairs

  23. Quiet for 3 weeks

    Fri 23 JanDay 1501
    1. ShinyHunters group opens new dark web leak site, claims responsibility for OKTA vishing campaign14:06 · DataBreaches · Picked up again
  24. Sat 24 JanDay 1511
    1. ShinyHunters claim to be behind SSO-account data theft attacks12:25 · DataBreaches

  25. Quiet for 2 days

    Mon 26 JanDay 1531
    1. ShinyHunters claims 2 Million Crunchbase records; company confirms breach16:36 · Security Affairs · Picked up again
  26. Tue 27 JanDay 1541
    1. Over 100 Organizations Targeted in ShinyHunters Phishing Campaign15:10 · SecurityWeek

  27. Quiet for 3 days

    Fri 30 JanDay 1571
    1. Match, Hinge, OkCupid, and Panera Bread breached by ransomware group15:15 · Malwarebytes · Picked up again
  28. Sat 31 JanDay 1581
    1. Mandiant Finds ShinyHunters-Style Vishing Attacks Stealing MFA to Breach SaaS Platforms08:55 · The Hacker News

  29. Quiet for 2 days

    Mon 2 FebDay 1602
    1. ShinyHunters-Branded Extortion Activity Expands, Escalates15:35 · SecurityWeek · Picked up again
    2. ShinyHunters Expands Scope of SaaS Extortion Attacks16:40 · Dark Reading
  30. Wed 4 FebDay 1621
    1. “IT Support” Imposters: ShinyHunters Vishing Rings Bypass MFA to Steal Data02:10 · SecurityOnline

  31. Quiet for 13 days

    Mon 16 FebDay 1741
    1. ShinyHunters leaked 600K+ Canada Goose customer records, but the firm denies it was breached15:50 · Security Affairs · Picked up again

  32. Quiet for 8 days

    Tue 24 FebDay 1821
    1. Shinyhunters threaten to leak 8M records from Dutch telecom Odido14:31 · DataBreaches · Picked up again
  33. Wed 25 FebDay 1834
    1. Wynn confirms ShinyHunters leak group stole 800,000 staff records11:40 · SecurityWeek
    2. Extortion group ShinyHunters leaks 12.5m CarGurus PII12:41 · SecurityWeek
    3. ShinyHunters cybercrime group leaks 12.4M CarGurus user records12:41 · Security Affairs
    4. Wynn confirms breach after ShinyHunters deleted data13:51 · DataBreaches

  34. Quiet for 4 days

    Sun 1 MarDay 1871
    1. ShinyHunters Exposes Odido Data in Netherlands' Largest Data Leak19:53 · Security Affairs · Picked up again

  35. Quiet for 9 days

    Tue 10 MarDay 1962
    1. ShinyHunters Exploit Salesforce Experience Cloud via Guest Access10:17 · Infosecurity · Picked up again
    2. ShinyHunters Hit Salesforce Aura Inspector Data Theft12:52 · SecurityWeek

  36. Quiet for 2 weeks

    Wed 25 MarDay 2111
    1. Infinite Campus Security Incident Awareness: No Impact to Student Data According to Infinite Campus12:44 · DataBreaches · Picked up again

  37. Quiet for 3 days

    Sat 28 MarDay 2141
    1. ShinyHunters claims the hack of the European Commission17:05 · Security Affairs · Picked up again
  38. Sun 29 MarDay 2151
    1. Security Affairs newsletter Round 569 by Pierluigi Paganini – INTERNATIONAL EDITION09:58 · Security Affairs
  39. Mon 30 MarDay 2161
    1. European Commission Reports Cyber Intrusion and Data Theft11:41 · SecurityWeek

  40. Quiet for 2 days

    Wed 1 AprDay 2181
    1. Trivy-Linked Cisco Breach & ShinyHunters’ Stolen Data Claim20:42 · SOCRadar · Picked up again

  41. Quiet for 2 days

    Fri 3 AprDay 2203
    1. TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments, (Fri, Apr 3rd)14:11 · SANS ISC · Exploited CVE · Known exploited CVE
    2. TeamPCP supply chain breach hits Mercor and EU Commission clouds16:31 · Dark Reading
    3. Attackers breach EU Commission site via Trivy supply chain attack22:41 · DataBreaches
  42. Sat 4 AprDay 2211
    1. European Commission hit by 340GB data breach via AWS Europa hack11:06 · SecurityWeek

  43. Quiet for 3 days

    Tue 7 AprDay 2242
    1. Wynn Resorts hit by ShinyHunters breach affecting 21,775 staff06:21 · SecurityWeek · Picked up again
    2. Hims & Hers confirms Zendesk breach exposed support data11:10 · Malwarebytes

  44. Quiet for 3 days

    Fri 10 AprDay 2271
    1. Hims breach exposes customer support tickets with personal info21:18 · Dark Reading · Picked up again

  45. Quiet for 4 days

    Tue 14 AprDay 2311
    1. ShinyHunters leak Rockstar data via third party cloud breach12:11 · Security Affairs · Picked up again

  46. Quiet for 6 days

    Mon 20 AprDay 2372
    1. Vercel breach traced to compromised third party AI tool05:00 · The Hacker News · Picked up again
    2. Vercel breach traced to compromised AI tool, $2M data sale08:41 · SecurityWeek
  47. Tue 21 AprDay 2381
    1. Attackers breached Vercel via compromised Context[.]ai OAuth app07:01 · SOCRadar

  48. Quiet for 7 days

    Mon 27 AprDay 2441
    1. Medtronic breach confirmed after ShinyHunters claims 9M records20:30 · Security Affairs · Picked up again
  49. Tue 28 AprDay 2453
    1. Medtronic confirms breach after ShinyHunters data leak claim06:50 · SecurityWeek
    2. Medtronic investigates breach after ShinyHunters data claim16:10 · Infosecurity
    3. Vimeo breach hits Anodot, emails exposed by ShinyHunters17:20 · SecurityWeek
  50. Wed 29 AprDay 2461
    1. ShinyHunters exploit Anodot incident to target Vimeo08:31 · Security Affairs

  51. Quiet for 5 days

    Mon 4 MayDay 2512
    1. ShinyHunters strike Instructure again, exposing 275m records00:21 · DataBreaches · Picked up again
    2. Instructure breach exposes 275M as ShinyHunters leaks data07:08 · SecurityWeek
  52. Tue 5 MayDay 2522
    1. Instructure investigating Canvas breach after ShinyHunters claim08:11 · Security Affairs
    2. Vimeo confirms data breach via Anodot, exposing 119k users19:31 · Security Affairs
  53. Wed 6 MayDay 2533
    1. ShinyHunters Leaks 119k Vimeo Users' Emails After April Hack11:51 · DataBreaches
    2. Instructure Canvas breach exposes 275 million education records13:32 · Malwarebytes
    3. Instructure Canvas breach leaks data of 275M users21:32 · Dark Reading
  54. Thu 7 MayDay 2541
    1. ShinyHunters Hit Instructure Canvas Again, Threaten School Data Leak22:51 · DataBreaches
  55. Fri 8 MayDay 2556
    1. Canvas outage hits schools as hackers threaten data leak10:58 · SecurityWeek
    2. ShinyHunters hijack Canvas logins, threaten schools with leak12:40 · Malwarebytes
    3. Canvas Restored Sparks Debate Over Paying Ransomware Demands13:11 · DataBreaches
    Show 3 more from 8 May
    1. Zara Data Breach: 197,000 Customers Exposed in Third-Party Security Incident15:32 · Security Affairs
    2. Canvas outage hits US school finals, ShinyHunters claims breach18:59 · Ars Technica
    3. ShinyHunters claims second Canvas breach, 275m records at risk20:40 · Dark Reading

  56. Quiet for 3 days

    Mon 11 MayDay 2584
    1. Canvas System Is Online After a Cyberattack Disrupted Thousands of Schools08:40 · SecurityWeek · Picked up again
    2. Zara breach leaks 197k records after ShinyHunters attack09:19 · Infosecurity
    3. ShinyHunters ramps up Canvas breach extortion targeting schools10:27 · Infosecurity
    4. Ivanti EPMM and PAN OS flaws hit as patches roll out mid May14:01 · The Hacker News · Known exploited CVE
  57. Tue 12 MayDay 2594
    1. Instructure reaches deal with ShinyHunters after 9k org breach08:01 · The Hacker News
    2. Canvas Data 'Returned' After ShinyHunters Deal, but Risk Remains09:12 · Malwarebytes
    3. Instructure reaches deal with hackers to delete stolen Canvas data13:50 · SecurityWeek
    4. Homeland Security wants to know about the Instructure breach; we still want to know about the Navigate360 breach14:31 · DataBreaches
  58. Wed 13 MayDay 2603
    1. Instructure settles Canvas breach, ShinyHunters return data11:32 · Security Affairs
    2. Congress Demands Details on Canvas Cyberattack Affecting Millions12:51 · SecurityWeek
    3. Instructure reaches agreement with ShinyHunters over Canvas breach14:49 · Infosecurity

  59. Quiet for 3 days

    Sat 16 MayDay 2631
    1. Another detail emerges about Instructure’s agreement with ShinyHunters; Debate continues about whether to pay17:51 · DataBreaches · Picked up again

  60. Quiet for 2 days

    Mon 18 MayDay 2652
    1. ShinyHunters leaks 600k Salesforce records from 7Eleven breach11:32 · SecurityWeek
    2. ShinyHunters says 7 Eleven breach exposed 600k Salesforce records14:32 · Security Affairs

  61. Quiet for 8 days

    Tue 26 MayDay 2731
    1. ShinyHunters leak 185k 7 Eleven records, data on HaveIBeenPwned12:11 · SecurityWeek · Picked up again

  62. Quiet for 2 days

    Thu 28 MayDay 2752
    1. Carnival breach exposes 6 million after employee account hijacked12:17 · Malwarebytes · Picked up again
    2. Carnival breach exposes 6 million via social engineering attack14:46 · SecurityWeek
  63. Fri 29 MayDay 2761
    1. ShinyHunters claims Charter data leak, HIBP notes 4.9M affected15:28 · SecurityWeek
  64. Sat 30 MayDay 2771
    1. ShinyHunters leaks 4.9M Charter records after ransom ignored17:51 · Security Affairs
  65. Sun 31 MayDay 2781
    1. ShinyHunters Leak 5 Million Charter Communications Records15:31 · Security Affairs

  66. Quiet for 5 days

    Fri 5 JunDay 2831
    1. ShinyHunters Leak Exposes 2.6M DentaQuest Dental Records11:55 · SecurityWeek · Picked up again

  67. Quiet for 2 days

    Sun 7 JunDay 2851
    1. DentaQuest breach exposes 2.6M patient data after ShinyHunters19:30 · Security Affairs · Picked up again

  68. Quiet for 4 days

    Thu 11 JunDay 2894
    1. University of Nottingham Confirms Breach After Hackers Leak Data08:51 · SecurityWeek · Picked up again
    2. Oracle issues urgent patch for PeopleSoft CVE-2026-35273 flaw14:06 · SecurityWeek · Known exploited CVE
    3. ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw20:47 · Google Cloud · Known exploited CVE
    4. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities21:20 · The Hacker News · Known exploited CVE
  69. Fri 12 JunDay 2907
    1. ShinyHunters hits education via Oracle PeopleSoft CVE-2026-3527303:01 · SecurityOnline · Known exploited CVE
    2. ShinyHunters exploit PeopleSoft CVE-2026-35273 at Nottingham06:50 · SecurityWeek · Known exploited CVE
    3. CVE-2026-35273 flaw used in ShinyHunters attack on universities11:29 · Security Affairs · Known exploited CVE
    Show 4 more from 12 Jun
    1. Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)14:21 · Rapid7 · Known exploited CVE
    2. ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide16:31 · DataBreaches · Known exploited CVE
    3. ShinyHunters exploit PeopleSoft flaw CVE-2026-35273, hit 100 unis19:50 · Ars Technica · Known exploited CVE
    4. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed21:01 · Dark Reading · Known exploited CVE
  70. Sat 13 JunDay 2911
    1. CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-3527309:51 · Security Affairs · Known exploited CVE
  71. Sun 14 JunDay 2921
    1. ShinyHunters threatens to leak Council of Europe data12:20 · DataBreaches
  72. Mon 15 JunDay 2931
    1. ShinyHunters says it breached Council of Europe, stole 300 GB10:50 · SecurityWeek · This article, 114th of 202

  73. Quiet for 2 days

    Wed 17 JunDay 2952
    1. EdTech firms hit by ShinyHunters and FulcrumSec cyberattacks10:09 · Security Affairs
    2. Cybercriminals Are Targeting EdTech: Data Breaches and Ransomware Attacks on the Rise12:31 · DataBreaches
  74. Thu 18 JunDay 2962
    1. Kodak Confirms Breach After ShinyHunters Steals 2.2M Records07:30 · SecurityWeek
    2. Kodak Confirms ShinyHunters Extortion Breach Affecting 2.2 Million10:30 · Malwarebytes
  75. Fri 19 JunDay 2971
    1. Amazon-owned One Medical Faces ShinyHunters Data Leak Threat01:10 · DataBreaches

  76. Quiet for 3 days

    Mon 22 JunDay 3001
    1. ShinyHunters shift focus to stolen credentials and token abuse10:57 · SecurityWeek · Picked up again

  77. Quiet for 5 days

    Sat 27 JunDay 3051
    1. NAIC Hit by ShinyHunters Cyber Attack, Leaks 3.1 TB of Data12:49 · DataBreaches · Picked up again

  78. Quiet for 2 days

    Mon 29 JunDay 3071
    1. NAIC PeopleSoft Zero-Day Hack by ShinyHunters, Denies Leak13:50 · SecurityWeek · Picked up again
  79. Tue 30 JunDay 3082
    1. Nissan Employee Data Breached in Oracle PeopleSoft Hack09:32 · SecurityWeek
    2. Nissan employee data exposed via Oracle PeopleSoft zero day flaw16:10 · Infosecurity

  80. Quiet for 3 days

    Fri 3 JulDay 3111
    1. Medtronic Warns 3.8M After ShinyHunters Steals Patient Data10:21 · SecurityWeek · Picked up again

  81. Quiet for 2 days

    Sun 5 JulDay 3131
    1. Medtronic Breach Hits 3.8M, Tied to ShinyHunters Hackers19:41 · Security Affairs · Picked up again

  82. Quiet for 8 days

    Mon 13 JulDay 3212
    1. Dutch police seek local hackers in Odido breach affecting 6M10:21 · Security Affairs · Picked up again
    2. Microsoft Warns ShinyHunters Abuse OAuth to Hit SaaS Firms23:31 · Microsoft
  83. Tue 14 JulDay 3222
    1. Microsoft probes Salesforce data theft by ShinyHunters gang06:51 · The Hacker News
    2. Microsoft warns vishing attacks on misconfigured Salesforce access19:31 · DataBreaches

  84. Quiet for 5 days

    Sun 19 JulDay 3271
    1. Abbott probes cyberattacks on cancer diagnostics and LabCentral15:51 · DataBreaches · Picked up again
  85. Mon 20 JulDay 3281
    1. Abbott probes cyber breach claims as hackers threaten data leak15:30 · Malwarebytes

  86. Quiet for 7 days

    Mon 27 JulDay 3353
    1. DentaQuest data breach exposes millions after ShinyHunters leak10:08 · SecurityWeek · Picked up again
    2. DentaQuest breach exposes 23 million after ShinyHunters leak14:07 · Security Affairs
    3. Sextortion Emails Use ShinyHunters Data for Bitcoin Blackmail15:46 · Malwarebytes

  87. Quiet for 2 days

    Wed 29 JulDay 3372
    1. ShinyHunters Claims Ernst & Young Hack08:12 · SecurityWeek
    2. ShinyHunters threatens to leak EY tax data by July 3114:42 · Security Affairs

  88. Quiet for 4 days

    Sun 2 AugDay 3411
    1. Brinks Home breach leaks five million records in extortion bid14:41 · DataBreaches · Picked up again
  89. Mon 3 AugDay 3421
    1. ShinyHunters leaks Brinks Home data after ransom refusal12:01 · SecurityWeek

  90. Quiet for 11 days

    Fri 14 AugDay 3532
    1. Trezor breach leaks 14,000 customers' data via ShipMonk08:50 · SecurityWeek · Picked up again
    2. RingCentral breach by ShinyHunters exposes 1.6 million records10:31 · SecurityWeek

  91. Quiet for 9 days

    Sun 23 AugDay 3621
    1. ShinyHunters claim ReliaQuest hack, then delete tweet amid denial15:41 · DataBreaches · Picked up again
  92. Mon 24 AugDay 3632
    1. ReliaQuest refutes ShinyHunters leak, says fake login was used12:17 · DataBreaches
    2. ReliaQuest blocks ShinyHunters phishing, confirms no data breach17:56 · SecurityWeek
  93. Tue 25 AugDay 3641
    1. ReliaQuest says breach attempt exposed only view only dashboard09:40 · Infosecurity

  94. Quiet for 4 days

    Sat 29 AugDay 3681
    1. McKesson investigates breach after ShinyHunters claim 284M records01:32 · DataBreaches · Picked up again

  95. Quiet for 2 days

    Mon 31 AugDay 3702
    1. McKesson Breach: ShinyHunters Claims 284 Million Records Stolen13:18 · SecurityWeek · Picked up again
    2. McKesson suffers data breach after ShinyHunters voice phishing attack15:31 · Malwarebytes
  96. Tue 1 SepDay 3711
    1. McKesson Probes ShinyHunters Hack Exposing 284 Million Records08:56 · Infosecurity

  97. Quiet for 2 days

    Thu 3 SepDay 3731
    1. ReliaQuest Says ShinyHunters Phishing Attack Was Contained20:30 · Dark Reading · Picked up again

  98. Quiet for 7 days

    Thu 10 SepDay 3801
    1. McKesson Data Breach Exposes 6.4 Million After ShinyHunters Leak14:00 · DataBreaches · Picked up again

  99. Quiet for 9 days

    Sat 19 SepDay 3891
    1. ShinyHunters Claims It Breached and Defaced Clop’s Leak Site14:25 · DataBreaches · Picked up again · Known exploited CVE

  100. Quiet for 2 days

    Mon 21 SepDay 3914
    1. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims11:01 · Malwarebytes
    2. ShinyHunters Claims It Hacked and Extorted Clop Ransomware Group12:49 · Infosecurity · Known exploited CVE
    3. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets15:01 · SOCRadar · Known exploited CVE
    4. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin20:53 · Dark Reading · Known exploited CVE
  101. Tue 22 SepDay 3921
    1. ShinyHunters Claims FBI Breach Exposed Employees’ Private Data19:11 · DataBreaches
  102. Wed 23 SepDay 3936
    1. ShinyHunters Claims FBI Breach Exposed Agents and Job Applicants07:00 · The Hacker News
    2. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data07:36 · SecurityWeek · Known exploited CVE
    3. ShinyHunters Claims FBI Breach Exploited Oracle PeopleSoft Zero-Day10:30 · Infosecurity
    Show 3 more from 23 Sep
    1. ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data12:49 · Malwarebytes
    2. ShinyHunters Claims FBI Applicant Data Breach via Oracle Flaw14:38 · Security Affairs · Known exploited CVE
    3. FBI Investigates ShinyHunters Claim of Recruitment Site Breach21:50 · Ars Technica
  103. Thu 24 SepDay 3941
    1. ShinyHunters Claims FBI Breach Exploited Oracle PeopleSoft Zero Day09:59 · SecurityOnline
  104. Fri 25 SepDay 3951
    1. BragJack Lets Malicious Extensions Hijack Browser AI Assistants15:18 · SecurityWeek
  105. Sat 26 SepDay 3962
    1. ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign07:14 · Google Cloud · Known exploited CVE
    2. Attackers Bypass Web Firewalls to Plant Web Shells in PeopleSoft14:19 · The Hacker News

  106. Quiet for 2 days

    Mon 28 SepDay 3985
    1. Malwarebytes Warns of AI Backdoors, ClickFix Traps and Phishing07:30 · Malwarebytes
    2. Alleged FBI Medical Records Leak Exposes Employees’ Private Details09:47 · Malwarebytes
    3. ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass11:30 · SecurityWeek · Known exploited CVE
    Show 2 more from 28 Sep
    1. Check Point Warns of Active Exploits and AI-Powered Attacks14:30 · Check Point · Known exploited CVE
    2. Dutch Police Arrest Suspected ShinyHunters Hacker After Major Breaches15:30 · Krebs on Security · Known exploited CVE
  107. Tue 29 SepDay 3995
    1. Dutch Police Arrest Alleged ShinyHunters Member in Odido Probe08:35 · Security Affairs
    2. Dutch Police Arrest Suspected ShinyHunters Member in Amsterdam10:22 · The Hacker News · Known exploited CVE
    3. Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe11:30 · SecurityWeek · Known exploited CVE
    Show 2 more from 29 Sep
    1. ShinyHunters Claim They Will Not Publish Stolen FBI Personnel Data13:14 · DataBreaches
    2. Dutch Hacker Faces Murder Solicitation Charges in ShinyHunters Probe18:57 · DataBreaches
  108. Wed 30 SepDay 4001
    1. FBI Urges ShinyHunters Members to Turn Informant After Arrest10:50 · SecurityWeek

  109. Quiet for 3 days

    Sat 3 OctDay 4031
    1. ShinyHunters Hacker Detained in Jordan and Reportedly Aids FBI Investigation16:22 · DataBreaches · Picked up again
  110. Sun 4 OctDay 4042
    1. ShinyHunters Suspect Detained in Jordan and Cooperates With FBI08:00 · The Hacker News
    2. ShinyHunters Suspect Cooperates With FBI to Expose Group Associates14:57 · Security Affairs
  111. Mon 5 OctDay 4052
    1. Teen Hacker Arrested After ShinyHunters Claims FBI Data Breach07:35 · SecurityWeek
    2. Jordan Detains ShinyHunters Suspect Said to Be Helping FBI09:57 · SecurityOnline
  112. Tue 6 OctDay 4063
    1. FBI removes Accenture contractor after ShinyHunters breach exposes staff data07:46 · The Hacker News · Known exploited CVE
    2. FBI Drops Accenture Contractor After Breach Exposed Staff Data10:42 · Security Affairs
    3. FBI Removes Accenture Contractor After Employee Data Breach14:27 · SecurityWeek
  113. Wed 7 OctDay 4072
    1. ShinyHunters Suspect Arrested in Jordan as FBI Tightens the Net10:50 · Malwarebytes
    2. Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt14:31 · Krebs on Security · Known exploited CVE

  114. Quiet for 2 days

    Fri 9 OctDay 4092
    1. Pentagon Data Breach Exposes Records of 3.1 Million People17:36 · Dark Reading · Picked up again
    2. FBI Arrests Suspected ShinyHunters Co-Conspirator in Pennsylvania19:24 · The Hacker News
  115. Sat 10 OctDay 4102
    1. FBI arrests ransomware negotiator in ShinyHunters extortion probe01:00 · Krebs on Security
    2. FBI Arrests Canadian Man in ShinyHunters Hack Investigation12:24 · DataBreaches

  116. Quiet for 2 days

    Mon 12 OctDay 4123
    1. FBI Arrests Canadian Cybersecurity Executive Over ShinyHunters Ties10:22 · Infosecurity
    2. Cybersecurity Executive Arrested in FBI ShinyHunters Investigation10:58 · SecurityWeek
    3. Canadian Ransomware Negotiator Arrested in FBI ShinyHunters Crackdown22:36 · Security Affairs
  117. Tue 13 OctDay 4131
    1. Experts and Ransomware Groups Weigh In on ShinyHunters’ Future13:28 · DataBreaches

  118. Quiet for 2 days

    Thu 15 OctDay 4151
    1. UK Legal Aid Agency Breach Exposed Data Dating Back Before 200712:49 · DataBreaches
  119. Fri 16 OctDay 4161
    1. Ransomware Negotiator’s Arrest Exposes Crisis Vendor Vetting Gaps14:26 · Dark Reading

  120. Quiet for 3 days

    Mon 19 OctDay 4191
    1. US Investigators Probe Ransom Negotiators’ Ties to ShinyHunters14:00 · Krebs on Security · Picked up again

  121. Quiet for 8 days

    Tue 27 OctDay 4272
    1. ShinyHunters claims FBI breach as Clop leak site is hijacked15:02 · SOCRadar · Picked up again
    2. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution19:05 · thezdi.com · Known exploited CVE
  122. Wed 28 OctDay 4281
    1. ShinyHunters exploited three chained flaws in PeopleSoft08:01 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in