ShinyHunters — every breach we're tracking
Running log of incidents attributed to or claimed by ShinyHunters in public reporting, with what was exposed and what victims should do. Updated as new incidents are ingested.
Groups like ShinyHunters steal data first and extort second — and the stolen records rarely stay private. Once a victim organization's data hits a leak site, the personal details inside (names, emails, phones, addresses) get scraped into the same broker-and-dump ecosystem every doxxer searches. If an organization you've used appears below, treat your data as circulating.
Tracked incidents
Showing the 60 most recent of 143 incidents we've attributed to ShinyHunters.
Baxter International, Inc. Listed by shinyhunters Ransomware Group
Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along w…
Metabase Listed by shinyhunters Ransomware Group
:P | Updated: 12 August 2026 | SHA256: 84daf8f33954a0b03238a1e0da3ee109d5bc32acc134cfdddfac36b4b75d2480…
Carhartt, Inc. Listed by shinyhunters Ransomware Group
Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempt…
Sharecare, Inc. Listed by shinyhunters Ransomware Group
This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for …
Cook Medical LLC Listed by shinyhunters Ransomware Group
Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers,…
Cook Medical LLC Listed by shinyhunters Ransomware Group
Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers,…
Ali** ********** Listed by shinyhunters Ransomware Group
August 7, 2026 3:00 PM ET: Over 11.5 million records across Salesforce, ServiceNow, and Entra containing some PII of customers and employees…
Alcon Inc. Listed by shinyhunters Ransomware Group
Over 25 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 4 August 2026 before we l…
Lumenis Ltd. Listed by shinyhunters Ransomware Group
Over 1.1 million records containing some Pil of customers/employees and 176GB+ of internal corporate data was compromised. This is a fina…
Questel SAS Listed by shinyhunters Ransomware Group
Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. This is a final warning to …
RingCentral, Inc. Listed by shinyhunters Ransomware Group
Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) p…
Ernst & Young Listed by shinyhunters Ransomware Group
Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and …
BH Security, LLC. (brinkshome.com) Listed by shinyhunters Ransomware Group
Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak…
Ernst & Young Listed by shinyhunters Ransomware Group
Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and …
Abbott owned Exact Sciences Corporation Listed by shinyhunters Ransomware Group
You wouldn't want us to describe what was exfiltrated from you publicly. This is a final warning to reach out by 18 July 2026 before we leak…
Fluke Corporation Listed by shinyhunters Ransomware Group
Over 21 million Salesforce records containing some PII were compromised. The Company failed to reach an agreement with us despite our incred…
Ingram Content Group, Inc. Listed by shinyhunters Ransomware Group
The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Upd…
Adapt****** Listed by shinyhunters Ransomware Group
Data being leaked by today 12:00 AM New York time. | Updated: 25 June 2026 | Warning: FINAL WARNING PAY OR LEAK…
Amazon owned OneMedical.com Listed by shinyhunters Ransomware Group
Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital…
NAIC.org Listed by shinyhunters Ransomware Group
Over 3.1 terabytes of National Association of Insurance Commissioners data (105,000+ files) was compromised across the INSData statistical p…
icsecurity.com Listed by shinyhunters Ransomware Group
Over 2.7 million records and other internal corporate data was compromised. This is a final warning to reach out by 22 June 2026 before we l…
Kodak Confirms Data Breach Claimed by ShinyHunters
Kodak confirmed that an unauthorized third party gained temporary access to a limited amount of company data. The company engaged external c…
Sysco Data Breach (2026)
In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign. Data was subsequently pub…
icc.edu Listed by shinyhunters Ransomware Group
Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (…
moody.edu Listed by shinyhunters Ransomware Group
Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relatio…
kodak.com Listed by shinyhunters Ransomware Group
Over 2.2 million records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by …
Deep Well Services Listed by shinyhunters Ransomware Group
Over 7k records containing customer PII and other internal corporate data was compromised. This is a final warning to reach out by 18 June 2…
glendale.edu Listed by shinyhunters Ransomware Group
Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations,…
hccs.edu Listed by shinyhunters Ransomware Group
Hundreds of thousands of student records containing full name, home address, phone, email, date of birth, gender, ethnicity, enrollment stat…
coe.int Listed by shinyhunters Ransomware Group
Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources…
JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group Listed by shinyhunters Ransomware Group
Hundreds of thousands of records containing PII (SSN, DOB, etc.), W-2 tax records, pay data, physical scans of government identity documents…
Zayo.com & Allstream.com Listed by shinyhunters Ransomware Group
You wouldn't want us to describe what data was taken from you publicly here. A fair assessment of this breach in terms of criticality is a 9…
American Tower Data Breach (2026)
In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campai…
Ralph Lauren Data Breach (2026)
In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently publishe…
Nexstar.tv Listed by shinyhunters Ransomware Group
Over 1 million Salesforce records and other internal corporate data containing PII was compromised. This is a final warning to reach out by …
nottingham.ac.uk Listed by shinyhunters Ransomware Group
Over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports from the Univers…
Madison Square Garden Sports Data Breach (2026)
In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion cam…
BCD Travel Data Breach (2026)
In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign…
DentaQuest Data Breach (2026)
In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters "pay or leak" extortion campaign that resulted in…
DentaQuest.com Listed by shinyhunters Ransomware Group
You wouldn't want us to describe what data and how much data was compromised publicly. It is in your best interests to reply to us or we are…
Charter Communications, Inc. Listed by shinyhunters Ransomware Group
Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several…
Baker Distributing Data Breach (2026)
In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's "pay or leak" …
Houghton Mifflin Harcourt Company Listed by shinyhunters Ransomware Group
Your data was compromised in several of our campaigns throughout the past few months. We urge you to engage with us, it is in your best inte…
Cushman & Wakefield Data Breach (2026)
In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters grou…
Adelante Soluciones Financieras (Addi.com) Listed by shinyhunters Ransomware Group
Over 16M unique persons records containing significant PII, financial/transactions (credit cards), KYC and data from TransUnion and Experian…
Instructure Canvas LMS breach exposes 280M education records
ShinyHunters claimed responsibility for a cyberattack on education technology provider Instructure, operator of the widely-used Canvas LMS. …
TOWERPOINT WEALTH, LLC Listed by shinyhunters Ransomware Group
Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4 May 202…
Follett Software LLC Listed by shinyhunters Ransomware Group
Over 4M Salesforce records containing PII and other internal corporate data have been compromised. This is a final warning to reach out by 4…
Vimeo Data Breach (2026)
In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their "pay or leak" campaign. They subsequ…
ADT, Inc. (adt.com) Listed by shinyhunters Ransomware Group
Over 10M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out b…
Udemy, Inc. (udemy.com) Listed by shinyhunters Ransomware Group
Over 1.4M records containing PII and other internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out …
Aman Resorts (aman.com) Listed by shinyhunters Ransomware Group
Over 500k Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before w…
Carnival Corporation & plc (carnivalcorp.com) Listed by shinyhunters Ransomware Group
Over 8.7M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning …
Pitney Bowes Inc. (pb.com) Listed by shinyhunters Ransomware Group
Over 25M Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we…
Alert 360 Opco Inc. (alert360.com) Listed by shinyhunters Ransomware Group
Over 2.5M records containing PII and other internal corporate data have been compromised. Please read the chatlog of the negociation by clik…
Zara (zara.com) Listed by shinyhunters Ransomware Group
Your Bigquery instances data was compromised thanks to Anodot.com. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before w…
The Canada Life Assurance Company (canadalife.com) Listed by shinyhunters Ransomware Group
Over 5.6M Salesforce records containing PII have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before w…
Kemper Data Breach (2026)
In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" e…
Abrigo Data Breach (2026)
In April 2026, the fintech software company Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group. Shortly afte…
Marcus & Millichap Data Breach (2026)
In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters…
Your email leaked. See who’s selling your address.
Nobody can unleak a breach. But the people-search sites selling your address because of it? Those come down. The free scan shows you which ones have you, in 15 seconds. Then you pick what fits.