ShinyHunters — every breach we're tracking
Running log of incidents attributed to or claimed by ShinyHunters in public reporting, with what was exposed and what victims should do. Updated as new incidents are ingested.
Groups like ShinyHunters steal data first and extort second — and the stolen records rarely stay private. Once a victim organization's data hits a leak site, the personal details inside (names, emails, phones, addresses) get scraped into the same broker-and-dump ecosystem every doxxer searches. If an organization you've used appears below, treat your data as circulating.
Tracked incidents
Showing the 60 most recent of 167 incidents we've attributed to ShinyHunters.
Warning Listed by ShinyHunters Ransomware Group
Due to certain disinformation spreading once again, we are releasing this statement to confirm we are okay, our operations and infrastructur…
Final statement re PSA Listed by ShinyHunters Ransomware Group
Good afternoon, We have no further comments to make regarding our PSA statement we released the other day. Our organisation is highly confid…
Fresenius Medical Care Listed by ShinyHunters Ransomware Group
You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026…
Press Listed by ShinyHunters Ransomware Group
We are currently not distributing samples to any media agencies. Furthermore, our policy restricts sharing these materials strictly to estab…
PSA Listed by ShinyHunters Ransomware Group
Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During Quarter Two of this year the Fed…
Note to Cl0p-_ Listed by ShinyHunters Ransomware Group
IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: Email us from your official email at shinygroup@onionmail.com and lets see how rich …
Qi**** Listed by ShinyHunters Ransomware Group
Processing publication of this company unless they start negotiating appropriately. Deadline: 18 Sep 2026 | Updated: 17 Sep 2026 | Warning: …
Kimberly-Clark Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by 16 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Mak…
State of Florida DMV Listed by ShinyHunters Ransomware Group
Contact us, you know how. or we will release the files. View download button below for proof (samples). Deadline : 9 11 2026…
Medela.com Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by 08 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Mak…
Note to mr. databroker1 NEXUS DL Service Listed by ShinyHunters Ransomware Group
We've been trying to get ahold of you. We've made you several large offers for the data you possess (DL data). We don't believe you've seen …
NeoGen Corporation Listed by ShinyHunters Ransomware Group
Over 5 million Salesforce records compromised containing some PII and 541GB+ of Sharepoint internal corporate data was compromised. The Comp…
Neogen Corporation Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make…
McKesson Corporation Listed by ShinyHunters Ransomware Group
McKesson confirmed on 28 August 2026 that attackers took data tied to a subset of its Oncology & Multispecialty and Medical-Surgical custome…
Jack Henry & Associates Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make…
Elekta AB Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make…
CyrusOne, LLC. Listed by ShinyHunters Ransomware Group
Update 23 Aug: We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to eng…
ReliaQuest, LLC Listed by ShinyHunters Ransomware Group
This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being pro…
NovoCure Limited Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come yo…
BOK Financial Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come yo…
Cyrus****** Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come yo…
Notice Of Warning Listed by ShinyHunters Ransomware Group
We are currently experiencing an influx of volume. More leaks are on their way. Kindly be informed, it is in your best interests to not stal…
Logitech/ Streamlabs Listed by ShinyHunters Ransomware Group
This is a final warning to reach out by 21 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Mak…
Brinks Home Listed by ShinyHunters Ransomware Group
Over 4.9 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incred…
Cook Medical LLC Listed by ShinyHunters Ransomware Group
Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers,…
Metabase Listed by ShinyHunters Ransomware Group
:P | Updated: 12 August 2026 | SHA256: 84daf8f33954a0b03238a1e0da3ee109d5bc32acc134cfdddfac36b4b75d2480…
Carhartt, Inc. Listed by ShinyHunters Ransomware Group
Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempt…
Sharecare, Inc. Listed by ShinyHunters Ransomware Group
This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for …
Cook Medical LLC Listed by ShinyHunters Ransomware Group
Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers,…
Baxter International, Inc. Listed by ShinyHunters Ransomware Group
Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along w…
Ali** ********** Listed by ShinyHunters Ransomware Group
August 7, 2026 3:00 PM ET: Over 11.5 million records across Salesforce, ServiceNow, and Entra containing some PII of customers and employees…
Alcon Inc. Listed by ShinyHunters Ransomware Group
Over 25 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 4 August 2026 before we l…
Lumenis Ltd. Listed by ShinyHunters Ransomware Group
Over 1.1 million records containing some Pil of customers/employees and 176GB+ of internal corporate data was compromised. This is a fina…
Questel SAS Listed by ShinyHunters Ransomware Group
Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. This is a final warning to …
Ernst & Young Listed by ShinyHunters Ransomware Group
Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and …
RingCentral, Inc. Listed by ShinyHunters Ransomware Group
Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) p…
BH Security, LLC. (brinkshome.com) Listed by ShinyHunters Ransomware Group
Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak…
Ernst & Young Listed by ShinyHunters Ransomware Group
Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and …
Abbott owned Exact Sciences Corporation Listed by ShinyHunters Ransomware Group
You wouldn't want us to describe what was exfiltrated from you publicly. This is a final warning to reach out by 18 July 2026 before we leak…
Fluke Corporation Listed by ShinyHunters Ransomware Group
Over 21 million Salesforce records containing some PII were compromised. The Company failed to reach an agreement with us despite our incred…
Ingram Content Group, Inc. Listed by ShinyHunters Ransomware Group
The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Upd…
Adapt****** Listed by ShinyHunters Ransomware Group
Data being leaked by today 12:00 AM New York time. | Updated: 25 June 2026 | Warning: FINAL WARNING PAY OR LEAK…
icsecurity.com Listed by ShinyHunters Ransomware Group
Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we l…
Amazon owned OneMedical.com Listed by ShinyHunters Ransomware Group
Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital…
NAIC.org Listed by ShinyHunters Ransomware Group
Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical p…
Kodak Confirms Data Breach Claimed by ShinyHunters
Kodak confirmed that an unauthorized third party gained temporary access to a limited amount of company data. The company engaged external c…
hccs.edu Listed by ShinyHunters Ransomware Group
Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment stat…
glendale.edu Listed by ShinyHunters Ransomware Group
Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations,…
Sysco Data Breach (2026)
In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign. Data was subsequently pub…
icc.edu Listed by ShinyHunters Ransomware Group
Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (…
moody.edu Listed by ShinyHunters Ransomware Group
Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relatio…
kodak.com Listed by ShinyHunters Ransomware Group
Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by …
Deep Well Services Listed by ShinyHunters Ransomware Group
Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2…
coe.int Listed by ShinyHunters Ransomware Group
Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources…
American Tower Data Breach (2026)
In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campai…
JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group Listed by ShinyHunters Ransomware Group
Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 tax records, pay data, physical scans of government identity documents…
Zayo.com & Allstream.com Listed by ShinyHunters Ransomware Group
You wouldn't want us to describe what data was taken from you publicly here. A fair assessment of this breach in terms of criticality is a 9…
Ralph Lauren Data Breach (2026)
In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently publishe…
Nexstar.tv Listed by ShinyHunters Ransomware Group
Over 1 million Salesforce records and other internal corporate data containing PII was compromised. This is a final warning to reach out by …
nottingham.ac.uk Listed by ShinyHunters Ransomware Group
Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the Univers…
Your email leaked. See who’s selling your address.
Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.