shinyhunters
First seen October 3, 2025Active156 claimed victims
The claims below are reproduced as posted by shinyhunters on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Note to mr. databroker1 NEXUS DL Service | September 4, 2026 | ransomlook | — |
| NeoGen Corporation | September 3, 2026 | ransomlook | — |
| Neogen Corporation | August 30, 2026 | ransomlook | — |
| McKesson Corporation | August 29, 2026 | ransomlook | — |
| Jack Henry & Associates | August 29, 2026 | ransomlook | — |
| Elekta AB | August 29, 2026 | ransomlook | — |
| ReliaQuest, LLC | August 23, 2026 | ransomware_live | — |
| CyrusOne, LLC. | August 23, 2026 | ransomware_live | — |
| BOK Financial | August 22, 2026 | ransomware_live | — |
| NovoCure Limited | August 22, 2026 | ransomware_live | — |
| Cyrus****** | August 20, 2026 | ransomware_live | — |
| Logitech/ Streamlabs | August 18, 2026 | ransomware_live | — |
| Baxter International, Inc. | August 14, 2026 | ransomware_live | — |
| Cook Medical LLC | August 14, 2026 | ransomware_live | — |
| Carhartt, Inc. | August 13, 2026 | ransomware_live | — |
| Sharecare, Inc. | August 13, 2026 | ransomware_live | — |
| Metabase | August 12, 2026 | ransomware_live | — |
| Ali** ********** | August 8, 2026 | ransomware_live | — |
| Lumenis Ltd. | August 1, 2026 | ransomware_live | — |
| Questel SAS | August 1, 2026 | ransomware_live | — |
| Alcon Inc. | August 1, 2026 | ransomware_live | — |
| Ernst & Young | July 27, 2026 | ransomware_live | — |
| RingCentral, Inc. | July 27, 2026 | ransomware_live | — |
| BH Security, LLC. (brinkshome.com) | July 27, 2026 | ransomware_live | — |
| Abbott owned Exact Sciences Corporation | July 15, 2026 | ransomware_live | — |
| Ingram Content Group, Inc. | July 1, 2026 | ransomware_live | — |
| Fluke Corporation | July 1, 2026 | ransomware_live | — |
| Adapt****** | June 24, 2026 | ransomware_live | — |
| NAIC.org | June 18, 2026 | ransomware_live | — |
| Amazon owned OneMedical.com | June 18, 2026 | ransomware_live | — |
| icsecurity.com | June 18, 2026 | ransomware_live | — |
| Ralph Lauren | June 16, 2026 | ransomware_live | — |
| Sysco Corporation | June 15, 2026 | ransomware_live | — |
| Deep Well Services | June 15, 2026 | ransomware_live | — |
| kodak.com | June 15, 2026 | ransomware_live | — |
| hccs.edu | June 15, 2026 | ransomware_live | — |
| glendale.edu | June 15, 2026 | ransomware_live | — |
| moody.edu | June 15, 2026 | ransomware_live | — |
| icc.edu | June 15, 2026 | ransomware_live | — |
| coe.int | June 13, 2026 | ransomware_live | — |
| Zayo.com & Allstream.com | June 12, 2026 | ransomware_live | — |
| American Tower Corporation | June 12, 2026 | ransomware_live | — |
| JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | June 12, 2026 | ransomware_live | — |
| Madison Square Garden Sports Corp. | June 12, 2026 | ransomware_live | — |
| Ralph Lauren Corporation | June 11, 2026 | ransomware_live | — |
| Nexstar.tv | June 11, 2026 | ransomware_live | — |
| nottingham.ac.uk | June 9, 2026 | ransomware_live | — |
| DentaQuest, LLC. | May 30, 2026 | ransomware_live | — |
| BCD Travel | May 29, 2026 | ransomware_live | — |
| DentaQuest, LLC | May 28, 2026 | ransomware_live | — |
| DentaQuest.com | May 23, 2026 | ransomware_live | — |
| Charter Communications, Inc. | May 23, 2026 | ransomware_live | — |
| Baker Distributing Company | May 23, 2026 | ransomware_live | — |
| Houghton Mifflin Harcourt Company | May 9, 2026 | ransomware_live | — |
| Adelante Soluciones Financieras (Addi.com) | May 5, 2026 | ransomware_live | — |
| Cushman & Wakefield Inc. | May 3, 2026 | ransomware_live | — |
| Instructure Holdings, Inc. (Canva LMS, instructure.com) | May 3, 2026 | ransomware_live | — |
| Follett Software LLC | April 30, 2026 | ransomware_live | — |
| TOWERPOINT WEALTH, LLC | April 30, 2026 | ransomware_live | — |
| Vimeo, Inc. | April 28, 2026 | ransomware_live | — |
| ADT, Inc. (adt.com) | April 24, 2026 | ransomware_live | — |
| Udemy, Inc. (udemy.com) | April 24, 2026 | ransomware_live | — |
| Alert 360 Opco Inc. (alert360.com) | April 18, 2026 | ransomware_live | — |
| Zara (zara.com) | April 18, 2026 | ransomware_live | — |
| Carnival Corporation & plc (carnivalcorp.com) | April 18, 2026 | ransomware_live | — |
| 7-Eleven, Inc. (7-eleven.com) | April 18, 2026 | ransomware_live | — |
| Pitney Bowes Inc. (pb.com) | April 18, 2026 | ransomware_live | — |
| The Canada Life Assurance Company (canadalife.com) | April 18, 2026 | ransomware_live | — |
| Aman Resorts (aman.com) | April 18, 2026 | ransomware_live | — |
| Mytheresa | April 11, 2026 | ransomware_live | — |
| National Railroad Passenger Corporation (amtrak.com) | April 11, 2026 | ransomware_live | — |
| McGraw Hill, Inc. (mheducation.com) | April 11, 2026 | ransomware_live | — |
| Ryan, LLC. | April 11, 2026 | ransomware_live | — |
| Kemper Corporation | April 11, 2026 | ransomware_live | — |
| Marcus & Millichap, Inc. | April 11, 2026 | ransomware_live | — |
| Abrigo, Inc. | April 11, 2026 | ransomware_live | — |
| Rockstar Games | April 11, 2026 | ransomware_live | — |
| Hallmark Cards, Inc. & Hallmark Plus | March 31, 2026 | ransomware_live | — |
| ZenBusiness, Inc. | March 26, 2026 | ransomware_live | — |
| BreachForums version 5 | March 26, 2026 | ransomware_live | — |
| European Commission (*.europa.eu) | March 26, 2026 | ransomware_live | — |
| Berkadia Commercial Mortgage, LLC. (berkadia.com) | March 24, 2026 | ransomware_live | — |
| Infinite Campus, Inc. | March 22, 2026 | ransomware_live | — |
| Ameriprise Financial, Inc. | March 22, 2026 | ransomware_live | — |
| Berkadia Commercial Mortgage LLC | March 19, 2026 | ransomware_live | — |
| Aura Group, Inc. (aura.com) | March 15, 2026 | ransomware_live | — |
| Aura Group, Inc | March 12, 2026 | ransomware_live | — |
| Salesforce Aura Campaign | March 9, 2026 | ransomware_live | — |
| Vertex Inc. | March 9, 2026 | ransomware_live | — |
| CFGI Management (cfgi.com) | March 9, 2026 | ransomware_live | — |
| Pathstone.com | March 6, 2026 | ransomware_live | — |
| CFGI Management, LLC. | March 6, 2026 | ransomware_live | — |
| Woflow, Inc. | March 3, 2026 | ransomware_live | — |
| Pathstone Family Office, LLC | February 27, 2026 | ransomware_live | — |
| Odido NL & Ben.nl | February 24, 2026 | ransomware_live | — |
| Beacon Pointe Advisors | February 22, 2026 | ransomware_live | — |
| Mercer Advisors | February 21, 2026 | ransomware_live | — |
| CarGurus, Inc. | February 21, 2026 | ransomware_live | — |
| Canada Goose | February 15, 2026 | ransomware_live | — |
| Figure Technology Solutions, Inc. | February 13, 2026 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).