// THREAT ACTOR
SHINYHUNTERS_
ActiveSHINYHUNTERS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of SHINYHUNTERS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
97
Victims tracked
3 / 8
Active mirrors
2026-01-23
First listing
2026-07-06
Most recent
Victims by year
- 2026 97
Leak site mirrors
8 mirrors tracked, 3 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onionSH snapshot · 2026-04-01 01:14 -
shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onionsnapshot · 2026-06-19 10:07 -
91.215.85.22.// SH snapshot · 2026-06-24 19:42 -
shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onionDDOS Protection snapshot · 2026-07-08 16:13 -
shinyhunte.rs[sh] shinyhunters snapshot · 2026-05-11 08:04 -
91.202.233.104.// SH snapshot · 2026-07-08 19:00 -
176.120.22.24.snapshot · 2026-07-08 18:37 -
91.215.85.103.// SH snapshot · 2026-07-08 19:06
Recent victims
The 50 most recent victims claimed by SHINYHUNTERS. Total in the index: 97.
| Date listed | Victim | Description |
|---|---|---|
| 2026-07-06 | Fluke Corporation | Over 21 million Salesforce records containing some PII were compromise… |
| 2026-07-06 | Ingram Content Group, Inc. | The Company failed to reach an agreement with us despite our incredibl… |
| 2026-06-25 | naic.org | The previous statement was overstated due to an analytical error and a… |
| 2026-06-19 | icsecurity.com | Over 2.7 million records and other internal corporate data was comprom… |
| 2026-06-18 | Amazon owned OneMedical.com | Over 8.8TB of data was compromised. This is a final warning to reach … |
| 2026-06-18 | NAIC.org | Over 3.1 terabytes of National Association of Insurance Commissioners … |
| 2026-06-17 | Service Notice: Scheduled Maintenance and Infrastructure Upgrades | * The primary server hosting all leaked data is currently undergoing s… |
| 2026-06-16 | Ralph Lauren | Over 220GB of data containing customer PII, purchase/trasnaction info,… |
| 2026-06-15 | icc.edu | Over 28 gigabytes of Illinois Central College data (122,000+ files) wa… |
| 2026-06-15 | moody.edu | Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of… |
| 2026-06-15 | glendale.edu | Over 62 gigabytes of Glendale Community College data (304,000+ files) … |
| 2026-06-15 | hccs.edu | Hundreds of thousands of student records containing full name, home ad… |
| 2026-06-15 | kodak.com | Over 2.2 million records containing customer PII and other internal co… |
| 2026-06-15 | Deep Well Services | Over 7k records containing customer PII and other internal corporate d… |
| 2026-06-15 | Sysco Corporation | Over 61 million Salesforce records across several tables, some contain… |
| 2026-06-14 | coe.int | Over 297 GB of Council of Europe HR and payroll data (429,000+ files) … |
| 2026-06-12 | Madison Square Garden Sports Corp. | Over 26 million records containing customer PII and other internal cor… |
| 2026-06-12 | JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 … |
| 2026-06-12 | American Tower Corporation | Over 5.2 million records consiting of a significant amount of customer… |
| 2026-06-12 | Zayo.com & Allstream.com | You wouldn't want us to describe what data was taken from you publicly… |
| 2026-06-12 | Nexstar.tv | Over 1 million Salesforce records and other internal corporate data co… |
| 2026-06-12 | Ralph Lauren Corporation | Over 220GB of data containing customer PII, purchase/trasnaction info,… |
| 2026-06-11 | Notice | Due to the significant influx of activity going on, we are kindly advi… |
| 2026-06-09 | nottingham.ac.uk | Over 40 GB of billing and payment records, credit card and payment det… |
| 2026-05-30 | DentaQuest, LLC. | The company failed to reach an agreement with us despite our incredibl… |
| 2026-05-29 | BCD Travel | Over 700k Salesforce records and various Sharepoint sites corporate da… |
| 2026-05-28 | DentaQuest, LLC | You wouldn't want us to describe what data and how much data was compr… |
| 2026-05-23 | Baker Distributing Company | Over 260k Salesforce records containing PII and other internal corpora… |
| 2026-05-23 | Charter Communications, Inc. | Over 42M records containing PII have been compromised. This is a fin… |
| 2026-05-23 | DentaQuest.com | You wouldn't want us to describe what data and how much data was compr… |
| 2026-05-13 | PRESS STATEMENT 13/05/2026 | Due to the public looking for confirmation from us regarding the recen… |
| 2026-05-13 | Notification | The domain shinyhunte.rs was suspended, it is not operated and owned b… |
| 2026-05-09 | Houghton Mifflin Harcourt Company | Your data was compromised in several of our campaigns throughout the p… |
| 2026-05-08 | PRESS STATEMENT | Due to the significant amount of press inquries we are receiving every… |
| 2026-05-05 | Adelante Soluciones Financieras (Addi.com) | Over 16M unique persons records containing significant PII, financial/… |
| 2026-05-05 | Entire list of affected schools by Instructure breach | The download button below is a list of affected schools by the Instruc… |
| 2026-05-03 | Instructure Holdings, Inc. (Canva LMS, instructure.com) | Nearly 9,000 schools worldwide affected. 275 million individuals data … |
| 2026-05-03 | Cushman & Wakefield Inc. | Over 500k Salesforce records containing PII and other internal corpora… |
| 2026-05-01 | TOWERPOINT WEALTH, LLC | Salesforce records containing PII and other internal corporate data ha… |
| 2026-05-01 | Follett Software LLC | Over 4M Salesforce records containing PII and other internal corporate… |
| 2026-04-28 | Vimeo, Inc. | Your Snowflake and Bigquery instances data was compromised thanks to A… |
| 2026-04-24 | Udemy, Inc. (udemy.com) | Over 1.4M records containing PII and other internal corporate data hav… |
| 2026-04-24 | ADT, Inc. (adt.com) | Over 10M records containing PII and other internal corporate data have… |
| 2026-04-17 | Aman Resorts (aman.com) | Over 500k Salesforce records containing PII have been compromised. Pay… |
| 2026-04-17 | The Canada Life Assurance Company (aman.com) | Over 500k Salesforce records containing PII have been compromised. Pay… |
| 2026-04-17 | The Canada Life Assurance Company (canadalife.com) | Over 5.6M Salesforce records containing PII have been compromised. Pay… |
| 2026-04-17 | Pitney Bowes Inc. (pb.com) | Over 25M Salesforce records containing PII have been compromised. Pay … |
| 2026-04-17 | 7-Eleven, Inc. (7-eleven.com) | Over 600k Salesforce records containing PII and other internal corpora… |
| 2026-04-17 | Carnival Corporation & plc (carnivalcorp.com) | Over 8.7M records containing PII and other terabytes of internal corpo… |
| 2026-04-17 | Medtronic plc (medtronic.com) | Over 9M records containing PII and other terabytes of internal corpora… |