shinyhunters
First seen October 3, 2025Active168 claimed victims
The claims below are reproduced as posted by shinyhunters on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Vertex Inc. | March 9, 2026 | ransomware_live | — |
| CFGI Management (cfgi.com) | March 9, 2026 | ransomware_live | — |
| Pathstone.com | March 6, 2026 | ransomware_live | — |
| CFGI Management, LLC. | March 6, 2026 | ransomware_live | — |
| Woflow, Inc. | March 3, 2026 | ransomware_live | — |
| Pathstone Family Office, LLC | February 27, 2026 | ransomware_live | — |
| Odido NL & Ben.nl | February 24, 2026 | ransomware_live | — |
| Beacon Pointe Advisors | February 22, 2026 | ransomware_live | — |
| Mercer Advisors | February 21, 2026 | ransomware_live | — |
| CarGurus, Inc. | February 21, 2026 | ransomware_live | — |
| Canada Goose | February 15, 2026 | ransomware_live | — |
| Figure Technology Solutions, Inc. | February 13, 2026 | ransomware_live | — |
| Harvard University | February 4, 2026 | ransomware_live | — |
| University of Pennsylvania | February 4, 2026 | ransomware_live | — |
| Bumble Inc. | January 28, 2026 | ransomware_live | — |
| Match Group | January 27, 2026 | ransomware_live | — |
| Panera Bread | January 26, 2026 | ransomware_live | — |
| Albertsons Companies, Inc. | October 11, 2025 | ransomware_live | — |
| Engie Resources | October 11, 2025 | ransomware_live | — |
| Telstra | October 8, 2025 | ransomware_live | — |
| CIC Vietnam | October 5, 2025 | ransomware_live | — |
| S&P Global (spglobal.com) | October 5, 2025 | ransomware_live | — |
| Edmunds.com, Inc. | September 30, 2025 | ransomware_live | — |
| CarMax, Inc. | September 29, 2025 | ransomware_live | — |
| Betterment, LLC. | September 28, 2025 | ransomware_live | — |
| Crunchbase, Inc. | September 20, 2025 | ransomware_live | — |
| Red Hat, Inc. | September 13, 2025 | ransomware_live | — |
| Home Depot | September 7, 2025 | ransomware_live | — |
| UPS | September 3, 2025 | ransomware_live | — |
| FedEx | August 31, 2025 | ransomware_live | — |
| Marriott | August 17, 2025 | ransomware_live | — |
| Fujifilm | August 17, 2025 | ransomware_live | — |
| 1-800Accountant | August 17, 2025 | ransomware_live | — |
| SoundCloud | August 10, 2025 | ransomware_live | — |
| Stellantis | August 7, 2025 | ransomware_live | — |
| Air France & KLM | July 29, 2025 | ransomware_live | — |
| Cisco | July 23, 2025 | ransomware_live | — |
| Engie Resources (Plymouth) | July 18, 2025 | ransomware_live | — |
| Walgreens | July 14, 2025 | ransomware_live | — |
| Albertsons (Jewel Osco, etc) | July 14, 2025 | ransomware_live | — |
| HMH (hmhco.com) | July 8, 2025 | ransomware_live | — |
| Instructure.com - Canvas | July 7, 2025 | ransomware_live | — |
| Aeroméxico | July 4, 2025 | ransomware_live | — |
| Republic Services | June 30, 2025 | ransomware_live | — |
| Google Adsense | June 30, 2025 | ransomware_live | — |
| Pandora.net | June 30, 2025 | ransomware_live | — |
| Qantas Airways | June 28, 2025 | ransomware_live | — |
| TransUnion | June 28, 2025 | ransomware_live | — |
| McDonalds | June 27, 2025 | ransomware_live | — |
| Chanel | June 27, 2025 | ransomware_live | — |
| KFC | June 26, 2025 | ransomware_live | — |
| Vietnam Airlines | June 20, 2025 | ransomware_live | — |
| ASICS | June 17, 2025 | ransomware_live | — |
| GAP, INC. | June 17, 2025 | ransomware_live | — |
| HBO Max | May 2, 2025 | ransomware_live | — |
| Puma | May 2, 2025 | ransomware_live | — |
| TripleA (aaa.com) | May 2, 2025 | ransomware_live | — |
| CarMax | May 2, 2025 | ransomware_live | — |
| Toyota Motor Corporations | May 1, 2025 | ransomware_live | — |
| Disney/Hulu | May 1, 2025 | ransomware_live | — |
| Instacart | May 1, 2025 | ransomware_live | — |
| Cartier | January 17, 2025 | ransomware_live | — |
| IKEA | September 8, 2024 | ransomware_live | — |
| Saks Fifth | June 5, 2024 | ransomware_live | — |
| Adidas | May 2, 2024 | ransomware_live | — |
| Petco | May 1, 2024 | ransomware_live | — |
| Cisco Systems, Inc. (cisco.com) | April 24, 2024 | ransomware_live | — |
| Kering (Gucci, Balenciaga, Brioni, AlexMcQ) | April 23, 2024 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).