ShinyHunters: hacker group, breaches and news

What is ShinyHunters

ShinyHunters is a cybercriminal extortion group that steals large databases from companies and institutions and demands payment to keep them private. It runs a pay-or-leak model: instead of encrypting systems like typical ransomware, it threatens to publish the stolen files on its own dark-web site and does so when the deadline passes. TechTimes describes it as a cybercrime brand that has survived arrests and infrastructure seizures and says it has claimed over 40 breaches in 2026 alone. Experts describe the people behind it as mainly young, English-speaking hackers focused on data theft and extortion.

One caveat applies to everything below: many figures come from the group itself, and victims often do not confirm them. Where it matters, the group’s claims are kept apart from what companies and law enforcement have confirmed.

Which companies has ShinyHunters attacked

In 2026 ShinyHunters claimed attacks on the FBI, Florida’s driver database, McKesson, Carhartt, RingCentral, the Council of Europe and Madison Square Garden Sports. The main cases:

The group’s leak site also listed Ernst & Young, Abbott-owned Exact Sciences and Brinks Home in August. It is unclear whether the EY entry refers to the breach of that firm’s support ticketing system disclosed earlier. Reports also tie the group to earlier attacks on Ticketmaster and Rockstar Games, and it has claimed breaches at PornHub and Vimeo.

The consequences are concrete. In the FBI case, public home addresses could endanger agents’ families. The Council of Europe has not announced a plan to notify affected people or offer credit monitoring. The MSG files include home addresses and internal risk ratings of public figures, and MSG uses facial recognition at its venues.

How does ShinyHunters hack companies

ShinyHunters mainly gets in through flaws in enterprise software, phished logins and stolen credentials rather than by encrypting systems. Four patterns appear in the reports.

Oracle PeopleSoft flaws. Mass attacks on Oracle PeopleSoft servers reached 300 instances at over 100 organizations, mostly in education; the University of Nottingham confirmed an incident. The attackers chain old flaws with zero-day exploits, meaning flaws unknown to the vendor that have no patch when the attack starts. The Council of Europe intrusion used CVE-2026-35273 (CVSS 9.8), which needs no authentication and affects PeopleTools 8.61 or 8.62 with an externally reachable Environment Management Hub. CISA added it to its known exploited vulnerabilities catalog on June 12.

Passkey-themed phishing. Microsoft warned about passkey phishing and Microsoft 365 data theft: since May 2026 attackers have called or messaged staff posing as IT help desks and urged them to update a passkey, MFA or SSO setup. The victim lands on a fake login page or is tricked into approving access with a device code. Attackers do not register a passkey. They capture the sign-in and session tokens, then copy files from SharePoint, OneDrive and mail slowly, over hours or days. Microsoft links part of this activity to Storm-3121, tied to ShinyHunters. The technique is covered in the phishing topic.

A phone call to an employee. A ShinyHunters spokesperson said it broke into RingCentral by voice-phishing a member of staff, with no exploit and no unpatched flaw. RingCentral called it a sophisticated social engineering campaign.

Stolen credentials. Florida confirms DMV breach via stolen police credentials: the department says the attacker used one Plant City police user’s credentials stored on a personal device. The group claims a password reset flaw gave it access to many DAVID accounts, including an FBI agent’s. Neither version has been independently verified. More context in driver’s license data leaks and government data breaches.

Have ShinyHunters members been arrested

Yes: two suspected members have been detained, but the group keeps announcing attacks. Dutch police arrested a suspected leader on September 15, a 24-year-old from Amsterdam. Krebs on Security and Reuters identified him as Pepijn van der Stap, convicted in 2023 of data theft and extortion. FBI Cyber Division Assistant Director Brett Leatherman called the suspect one of the group’s alleged leaders. ShinyHunters told Reuters he has no association with it.

The second case is Saif al-Din Khader, alias Rey, detained in Jordan. Three people familiar with the matter said he was taken into custody, two of them on Tuesday, and that he is cooperating with the FBI to identify fellow hackers. The circumstances of the detention are unknown. The FBI does not comment on specific arrests abroad but says it has already worked with partners to arrest multiple subjects. More such cases are in the cybercrime arrests topic.

Why did ShinyHunters attack the FBI and Cl0p

ShinyHunters says its FBI attack was retaliation for a May 2026 FBI FLASH report on its tactics, and in September it also took over the leak site of the Cl0p group. The group’s account of the FBI breach, as reported by BleepingComputer: entry through an unpatched Oracle PeopleSoft zero-day, then lateral movement into FBI-managed AWS GovCloud. The FBI confirmed only that it is investigating unauthorized activity affecting FBIjobs.gov. 404 Media received roughly 5,000 purported employee records and verified some details. A week later the FBI was still assessing damage and assuming data on all employees was stolen, while the group demanded the FBI amend its advisory about the group’s extortion tactics, which many read as a threat to leak.

Earlier, on the night of September 18, ShinyHunters defaced Cl0p’s leak site on Tor with Pokemon artwork and a message that the site had been pwned. The group says it entered through an unauthenticated file-upload flaw in Grav, the CMS behind the site, and took Cl0p’s source code, plugins and logs. It also claims Cl0p’s onion service keys, which analysts call unproven, and set a 72-hour ultimatum. Cl0p has not commented. The report says the feud appears to date to October 2025.

What it means for you

• A call, text or message from an “IT help desk” urging an urgent passkey, MFA or SSO update matches the scenario Microsoft described in campaigns by groups linked to ShinyHunters. Do not follow the link; open your company’s sign-in portal yourself.
• For Microsoft 365 admins, Microsoft recommends phishing-resistant MFA, restricting sensitive cloud resources to managed devices and disabling device-code authentication when it is not needed.
• Organizations with Oracle PeopleSoft reachable from the internet should check logs for the indicators of compromise published with the June campaign (IP addresses, a script that drops ransom notes).
• If you receive a breach notice, monitor bank statements and credit reports, keep the incident paperwork and consider a fraud alert.

Still open: whether McKesson and Carhartt will confirm the figures the group claims (284 million records and 12.9 million accounts), how far the FBI data theft reached, and whether the arrests in the Netherlands and Jordan will slow a group that keeps announcing attacks.