// THREAT ACTOR
SHINYHUNTERS_
ActiveSHINYHUNTERS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of SHINYHUNTERS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 117
Leak site mirrors
8 mirrors tracked, 4 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onionSH snapshot · 2026-04-01 01:14 -
shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onionshnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion snapshot · 2026-07-10 02:00 -
91.215.85.22.// SH snapshot · 2026-08-23 13:06 -
shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onionsnapshot · 2026-08-23 02:03 -
shinyhunte.rs[sh] shinyhunters snapshot · 2026-05-11 08:04 -
91.202.233.104.snapshot · 2026-08-23 12:22 -
176.120.22.24.// SH snapshot · 2026-08-23 12:03 -
91.215.85.103.// SH snapshot · 2026-08-23 12:21
Recent victims
The 50 most recent victims claimed by SHINYHUNTERS. Total in the index: 117.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-23 | ReliaQuest, LLC | This time the post is about you, not us. Let Mandiant report and advis… |
| 2026-08-22 | NovoCure Limited | This is a final warning to reach out by end of day 24 Aug 2026 before … |
| 2026-08-22 | BOK Financial | This is a final warning to reach out by end of day 24 Aug 2026 before … |
| 2026-08-20 | Cyrus****** | This is a final warning to reach out by end of day 24 Aug 2026 before … |
| 2026-08-18 | Logitech/ Streamlabs | This is a final warning to reach out by 21 Aug 2026 before we leak alo… |
| 2026-08-18 | Brinks Home | Over 4.9 million Salesforce records containing some PII was compromise… |
| 2026-08-18 | Alcon, Inc. | Over 25 million Salesforce records containing some PII was compromised… |
| 2026-08-18 | Lumenis Ltd. | Over 1.1 million records containing some PII of customers/employees an… |
| 2026-08-18 | Questel SAS | Over 21 million Salesforce records containing some PII and 147GB+ of i… |
| 2026-08-18 | Metabase | 😛 |
| 2026-08-18 | Sharecare, Inc. | This Company data was published due to them hiring a very incompetent … |
| 2026-08-18 | NOTICE OF WARNING | We are currently experiencing an influx of volume. More leaks are on t… |
| 2026-08-18 | Carhartt, Inc. | Our demand for this Company was $3.3 million. The Company reached out.… |
| 2026-08-18 | Cook Medical LLC | Customer data, employee data, and other internal corporate data was co… |
| 2026-08-18 | Baxter International, Inc. | Over 7.1M Salesforce records containing some PII was compromised. Th… |
| 2026-07-27 | BH Security, LLC. (brinkshome.com) | Over 4.9 million Salesforce records containing some PII was compromise… |
| 2026-07-27 | RingCentral, Inc. | Over XX of data was compromised. This is a final warning to reach out… |
| 2026-07-27 | Ernst & Young | Yes it was us. Now come talk to us. We have been trying to reach you. … |
| 2026-07-25 | [cdn] Notification | All CDN mirrors are currently experiencing a service disruption. All f… |
| 2026-07-15 | Abbott owned Exact Sciences Corporation | You wouldn't want us to describe what was exfiltrated from you publicl… |
| 2026-07-06 | Fluke Corporation | Over 21 million Salesforce records containing some PII were compromise… |
| 2026-07-06 | Ingram Content Group, Inc. | The Company failed to reach an agreement with us despite our incredibl… |
| 2026-06-25 | naic.org | The previous statement was overstated due to an analytical error and a… |
| 2026-06-19 | icsecurity.com | Over 2.7 million records and other internal corporate data was comprom… |
| 2026-06-18 | Amazon owned OneMedical.com | Over 8.8TB of data was compromised. This is a final warning to reach … |
| 2026-06-18 | NAIC.org | Over 3.1 terabytes of National Association of Insurance Commissioners … |
| 2026-06-17 | Service Notice: Scheduled Maintenance and Infrastructure Upgrades | * The primary server hosting all leaked data is currently undergoing s… |
| 2026-06-16 | Ralph Lauren | Over 220GB of data containing customer PII, purchase/trasnaction info,… |
| 2026-06-15 | icc.edu | Over 28 gigabytes of Illinois Central College data (122,000+ files) wa… |
| 2026-06-15 | moody.edu | Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of… |
| 2026-06-15 | glendale.edu | Over 62 gigabytes of Glendale Community College data (304,000+ files) … |
| 2026-06-15 | hccs.edu | Hundreds of thousands of student records containing full name, home ad… |
| 2026-06-15 | kodak.com | Over 2.2 million records containing customer PII and other internal co… |
| 2026-06-15 | Deep Well Services | Over 7k records containing customer PII and other internal corporate d… |
| 2026-06-15 | Sysco Corporation | Over 61 million Salesforce records across several tables, some contain… |
| 2026-06-14 | coe.int | Over 297 GB of Council of Europe HR and payroll data (429,000+ files) … |
| 2026-06-12 | Madison Square Garden Sports Corp. | Over 26 million records containing customer PII and other internal cor… |
| 2026-06-12 | JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 … |
| 2026-06-12 | American Tower Corporation | Over 5.2 million records consiting of a significant amount of customer… |
| 2026-06-12 | Zayo.com & Allstream.com | You wouldn't want us to describe what data was taken from you publicly… |
| 2026-06-12 | Nexstar.tv | Over 1 million Salesforce records and other internal corporate data co… |
| 2026-06-12 | Ralph Lauren Corporation | Over 220GB of data containing customer PII, purchase/trasnaction info,… |
| 2026-06-11 | Notice | Due to the significant influx of activity going on, we are kindly advi… |
| 2026-06-09 | nottingham.ac.uk | Over 40 GB of billing and payment records, credit card and payment det… |
| 2026-05-30 | DentaQuest, LLC. | The company failed to reach an agreement with us despite our incredibl… |
| 2026-05-29 | BCD Travel | Over 700k Salesforce records and various Sharepoint sites corporate da… |
| 2026-05-28 | DentaQuest, LLC | You wouldn't want us to describe what data and how much data was compr… |
| 2026-05-23 | Baker Distributing Company | Over 260k Salesforce records containing PII and other internal corpora… |
| 2026-05-23 | Charter Communications, Inc. | Over 42M records containing PII have been compromised. This is a fin… |
| 2026-05-23 | DentaQuest.com | You wouldn't want us to describe what data and how much data was compr… |
// CONFIRMED ATTACKS
ShinyHunters confirmed attacks: 2 verified incidents
Ransomnews has verified 2 ShinyHunters incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from November 2025 to April 2026. United Kingdom accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is technology, at 2 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 1; the outcome is unrecorded in the remaining 0.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified ShinyHunters incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| April 2026 | Canvas (Instructure) | Technology | Utah, United States | — | Yes | Source |
| November 2025 | Checkout.com | Technology | London, United Kingdom | — | No | Source |
Claimed vs confirmed. The figures above the fold on this page come from ShinyHunters's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.