shinyhunters
First seen October 3, 2025Active168 claimed victims
The claims below are reproduced as posted by shinyhunters on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| O'Reilly Automotive | October 2, 2026 | ransomlook | — |
| DexCom, Inc. | October 2, 2026 | ransomlook | — |
| WARNING | September 30, 2026 | ransomlook | — |
| Final statement re PSA | September 24, 2026 | ransomlook | — |
| PRESS RELEASE RE PSA | September 23, 2026 | ransomlook | — |
| Fresenius Medical Care | September 22, 2026 | ransomware_live | — |
| PSA - READ THIS NOW | September 22, 2026 | ransomlook | — |
| Note to Cl0p-_- | September 19, 2026 | ransomware_live | — |
| Qi**** | September 17, 2026 | ransomware_live | — |
| Kimberly-Clark | September 13, 2026 | ransomlook | — |
| State of Florida DMV | September 7, 2026 | ransomlook | — |
| Medela.com | September 7, 2026 | ransomlook | — |
| Note to mr. databroker1 NEXUS DL Service | September 4, 2026 | ransomlook | — |
| NeoGen Corporation | September 3, 2026 | ransomlook | — |
| Neogen Corporation | August 30, 2026 | ransomlook | — |
| McKesson Corporation | August 29, 2026 | ransomlook | reported in press coverage |
| Jack Henry & Associates | August 29, 2026 | ransomlook | — |
| Elekta AB | August 29, 2026 | ransomlook | — |
| ReliaQuest, LLC | August 23, 2026 | ransomware_live | — |
| CyrusOne, LLC. | August 23, 2026 | ransomware_live | — |
| BOK Financial | August 22, 2026 | ransomware_live | — |
| NovoCure Limited | August 22, 2026 | ransomware_live | — |
| Cyrus****** | August 20, 2026 | ransomware_live | — |
| Logitech/ Streamlabs | August 18, 2026 | ransomware_live | — |
| Baxter International, Inc. | August 14, 2026 | ransomware_live | — |
| Cook Medical LLC | August 14, 2026 | ransomware_live | — |
| Carhartt, Inc. | August 13, 2026 | ransomware_live | — |
| Sharecare, Inc. | August 13, 2026 | ransomware_live | — |
| Metabase | August 12, 2026 | ransomware_live | reported in press coverage |
| Ali** ********** | August 8, 2026 | ransomware_live | — |
| Lumenis Ltd. | August 1, 2026 | ransomware_live | — |
| Questel SAS | August 1, 2026 | ransomware_live | — |
| Alcon Inc. | August 1, 2026 | ransomware_live | — |
| Ernst & Young | July 27, 2026 | ransomware_live | — |
| RingCentral, Inc. | July 27, 2026 | ransomware_live | — |
| BH Security, LLC. (brinkshome.com) | July 27, 2026 | ransomware_live | — |
| Abbott owned Exact Sciences Corporation | July 15, 2026 | ransomware_live | — |
| Ingram Content Group, Inc. | July 1, 2026 | ransomware_live | — |
| Fluke Corporation | July 1, 2026 | ransomware_live | — |
| Adapt****** | June 24, 2026 | ransomware_live | — |
| NAIC.org | June 18, 2026 | ransomware_live | — |
| Amazon owned OneMedical.com | June 18, 2026 | ransomware_live | — |
| icsecurity.com | June 18, 2026 | ransomware_live | — |
| Ralph Lauren | June 16, 2026 | ransomware_live | — |
| Sysco Corporation | June 15, 2026 | ransomware_live | — |
| Deep Well Services | June 15, 2026 | ransomware_live | — |
| kodak.com | June 15, 2026 | ransomware_live | — |
| hccs.edu | June 15, 2026 | ransomware_live | — |
| glendale.edu | June 15, 2026 | ransomware_live | — |
| moody.edu | June 15, 2026 | ransomware_live | — |
| icc.edu | June 15, 2026 | ransomware_live | — |
| coe.int | June 13, 2026 | ransomware_live | — |
| Zayo.com & Allstream.com | June 12, 2026 | ransomware_live | — |
| American Tower Corporation | June 12, 2026 | ransomware_live | — |
| JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | June 12, 2026 | ransomware_live | — |
| Madison Square Garden Sports Corp. | June 12, 2026 | ransomware_live | — |
| Ralph Lauren Corporation | June 11, 2026 | ransomware_live | — |
| Nexstar.tv | June 11, 2026 | ransomware_live | — |
| nottingham.ac.uk | June 9, 2026 | ransomware_live | — |
| DentaQuest, LLC. | May 30, 2026 | ransomware_live | — |
| BCD Travel | May 29, 2026 | ransomware_live | — |
| DentaQuest, LLC | May 28, 2026 | ransomware_live | — |
| DentaQuest.com | May 23, 2026 | ransomware_live | — |
| Charter Communications, Inc. | May 23, 2026 | ransomware_live | — |
| Baker Distributing Company | May 23, 2026 | ransomware_live | — |
| Houghton Mifflin Harcourt Company | May 9, 2026 | ransomware_live | — |
| Adelante Soluciones Financieras (Addi.com) | May 5, 2026 | ransomware_live | — |
| Cushman & Wakefield Inc. | May 3, 2026 | ransomware_live | — |
| Instructure Holdings, Inc. (Canva LMS, instructure.com) | May 3, 2026 | ransomware_live | — |
| Follett Software LLC | April 30, 2026 | ransomware_live | — |
| TOWERPOINT WEALTH, LLC | April 30, 2026 | ransomware_live | — |
| Vimeo, Inc. | April 28, 2026 | ransomware_live | — |
| ADT, Inc. (adt.com) | April 24, 2026 | ransomware_live | — |
| Udemy, Inc. (udemy.com) | April 24, 2026 | ransomware_live | — |
| Alert 360 Opco Inc. (alert360.com) | April 18, 2026 | ransomware_live | — |
| Zara (zara.com) | April 18, 2026 | ransomware_live | — |
| Carnival Corporation & plc (carnivalcorp.com) | April 18, 2026 | ransomware_live | — |
| 7-Eleven, Inc. (7-eleven.com) | April 18, 2026 | ransomware_live | — |
| Pitney Bowes Inc. (pb.com) | April 18, 2026 | ransomware_live | — |
| The Canada Life Assurance Company (canadalife.com) | April 18, 2026 | ransomware_live | — |
| Aman Resorts (aman.com) | April 18, 2026 | ransomware_live | — |
| Mytheresa | April 11, 2026 | ransomware_live | — |
| National Railroad Passenger Corporation (amtrak.com) | April 11, 2026 | ransomware_live | — |
| McGraw Hill, Inc. (mheducation.com) | April 11, 2026 | ransomware_live | — |
| Ryan, LLC. | April 11, 2026 | ransomware_live | — |
| Kemper Corporation | April 11, 2026 | ransomware_live | — |
| Marcus & Millichap, Inc. | April 11, 2026 | ransomware_live | — |
| Abrigo, Inc. | April 11, 2026 | ransomware_live | — |
| Rockstar Games | April 11, 2026 | ransomware_live | — |
| Hallmark Cards, Inc. & Hallmark Plus | March 31, 2026 | ransomware_live | — |
| ZenBusiness, Inc. | March 26, 2026 | ransomware_live | — |
| BreachForums version 5 | March 26, 2026 | ransomware_live | — |
| European Commission (*.europa.eu) | March 26, 2026 | ransomware_live | — |
| Berkadia Commercial Mortgage, LLC. (berkadia.com) | March 24, 2026 | ransomware_live | — |
| Infinite Campus, Inc. | March 22, 2026 | ransomware_live | — |
| Ameriprise Financial, Inc. | March 22, 2026 | ransomware_live | — |
| Berkadia Commercial Mortgage LLC | March 19, 2026 | ransomware_live | — |
| Aura Group, Inc. (aura.com) | March 15, 2026 | ransomware_live | — |
| Aura Group, Inc | March 12, 2026 | ransomware_live | — |
| Salesforce Aura Campaign | March 9, 2026 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).