ShinyHunters 2026 Breach Tracker

The Numbers

And this isn’t some shadowy nation-state operation with unlimited resources. They run their extortion portal with the professionalism of a SaaS company. Their ransom emails include itemized lists of stolen data, Bitcoin payment instructions, 72-hour deadlines, and proof-of-theft samples hosted on Limewire ^[2].

Three Playbooks, One Group

Google Threat Intelligence Group tracks ShinyHunters as three linked threat clusters: UNC6661 and UNC6671 handle the initial break-ins, while UNC6240 runs the extortion side ^[2]. The division of labor is telling: this isn’t improvised. It’s industrialized.

Here’s how they get in:

Playbook 1: Voice Phishing + Adversary-in-the-Middle

An attacker calls an employee pretending to be IT support. “We’re rolling out new security compliance.” “Your passkey needs updating.” They direct the target to a lookalike domain (something like company-sso.com or companyinternal.com) that mirrors the real login page. A live operator relays the stolen credentials and MFA codes to the real identity provider in real time, capturing authenticated session tokens ^[3].

Victims hit this way: ADT (5.5M), Panera Bread (5.1M accounts), Match Group (10M+), Harvard University, University of Pennsylvania, Figure Technology (1M), SoundCloud (30M).

Playbook 2: Salesforce Experience Cloud Exploitation

ShinyHunters discovered that hundreds of companies had misconfigured their Salesforce Experience Cloud portals: guest user profiles with API access enabled or overly permissive Organization-Wide Defaults. They weaponized a modified version of AuraInspector, an open-source Salesforce audit tool, to mass-scan for vulnerable configurations ^[4].

In March 2026, Salesforce issued a security advisory. By then, ShinyHunters had already hit approximately 400 companies ^[4].

Victims hit this way: Canada Life (5.6M), Kemper (13M), McGraw-Hill (13.5M), TransUnion, and hundreds more. A separate ShinyHunters Salesforce campaign, the theft of Salesloft Drift OAuth tokens (tracked as UNC6395), reportedly netted around 1.5 billion records across roughly 760 organizations ^[9].

Playbook 3: OAuth Supply Chain Attacks

The most sophisticated approach. ShinyHunters compromise third-party integrators’ GitHub environments, stealing OAuth tokens and AWS credentials. Those tokens cascade downstream to every organization using the compromised integration ^[3].

The Anodot breach is the template: attackers compromised Anodot’s analytics platform, then used its access to reach Snowflake and BigQuery instances across multiple downstream customers ^[3].

Victims hit this way: Rockstar Games (78.6M), Vimeo (119K), Woflow (affecting DoorDash, Walmart, Uber).

The 2026 Breach Tracker

Every confirmed ShinyHunters breach in 2026, ordered by date. This list includes only confirmed incidents. The group has claimed additional victims that haven’t been verified.

This table is updated as new breaches are confirmed. Last updated: 2026-09-28.

Who Are ShinyHunters?

ShinyHunters formed in 2019. The name is a Pokémon reference: shiny hunting means obsessively searching for rare color variants. They have since become one of the most prolific data theft operations in history ^[1].

The group’s leader operates under the handle “shinycorp” and runs communications via Tutanota and OnionMail ^[2].

Law enforcement has taken some bites:

• May 2022: Sébastien Raoult, a French programmer, was arrested in Morocco and extradited to the U.S. ^[1]
• January 2024: Raoult was sentenced to three years in prison and ordered to return $5 million. ^[1]
• June 2025: Matthew D. Lane, 19, of Massachusetts, was charged by U.S. prosecutors in the District of Massachusetts with hacking and extorting an education-technology provider widely reported to be PowerSchool. ^[1]
• June 2025: French members of the ShinyHunters cybercriminal group were arrested in multiple French regions ^[1].

Per Wikipedia, the group’s leadership remained active throughout and after the arrests ^[1]. Arresting individual operators in a decentralized network is like pulling weeds: the roots are still in the ground.

The Pattern Nobody’s Fixing

Look at the breach tracker again. Notice what almost every victim has in common: Salesforce.

ShinyHunters didn’t find a zero-day in Salesforce. They didn’t need one. They found something better: misconfigured guest user permissions that gave anonymous API access to customer data, employee SSO credentials harvested over the phone, and third-party OAuth integrations with excessive access scopes ^[3][4].

Google’s Threat Intelligence report was blunt about it: “This activity is not the result of a security vulnerability in vendors’ products or infrastructure. Instead, it continues to highlight the effectiveness of social engineering” ^[2].

Translation: the software isn’t broken. The way companies deploy it is. And fixing configuration isn’t as exciting as buying new security tools, so it doesn’t happen until after the breach.

ShinyHunters also know that post-compromise cleanup is sloppy. Google observed them using a tool called ToogleBox Recall to delete Okta “Security method enrolled” notification emails from victims’ inboxes, hiding the evidence that an attacker’s device had been registered for MFA ^[2]. They used PowerShell to bulk-download from SharePoint and OneDrive. They pivoted from compromised accounts to send secondary phishing emails to cryptocurrency companies. None of this is novel. All of it keeps working.

The Ransom Question

The FBI’s position is clear: don’t pay ShinyHunters. Paying ransoms funds future attacks and emboldens further targeting ^[6].

Instructure paid anyway. After 275 million student records were exposed through Canvas, the company reached a settlement with ShinyHunters that included a “shred logs” clause: the attackers agreed to destroy the stolen data. Whether they actually did is unknowable. Whether the data had already been copied, shared, or sold is unknowable. Instructure paid for a promise from criminals.

The extortion model works precisely because companies face a calculation: the cost of paying ($1.5 million was ShinyHunters’ demand to Wynn Resorts ^[7]) vs. the cost of lawsuits, regulatory fines, and reputational damage. For many companies, paying is cheaper. And ShinyHunters know it.

What to Do Right Now

What Comes Next

ShinyHunters activity continued at scale through May 2026. The arrests of French members last June did not pause operations. The FBI’s Internet Crime Complaint Center issued a specific public service announcement on the learning management system attack vector on May 15, 2026 ^[10]. Charter Communications’ deadline was May 27 ^[8].

September 2026 FBI claim (not confirmed). On September 22, 2026, a ShinyHunters spokesperson told The Register the group had exploited an Oracle PeopleSoft zero-day vulnerability on the FBI jobs webpage, then moved laterally onto the FBI’s managed servers on AWS GovCloud and downloaded about 2 TB to 3 TB of data belonging to current, former, and prospective FBI employees ^[14]. The same day, a representative of the group told 404 Media: “We hacked the FBI. We hold data on all FBI employees and applicants” ^[13]. On September 23, 404 Media reported that the data includes members of the FBI’s Remote Operations Unit, which it describes as a highly secretive team of hackers making exploits and tools to break into targets’ devices ^[12]. On September 25, The Register reported that sample files reviewed by journalists and security researchers appear to contain agents’ home addresses, phone numbers, email addresses, Social Security numbers, job titles, assigned field office, and emergency contact information, and that the FBIJobs.gov portal remained down ^[11]. An FBI spokesperson told The Register: “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” adding that the point of breach, a third party or the FBI’s enterprise, is still undetermined ^[11]. The statement does not confirm what data was taken; the scope and contents described above remain the group’s claims as reported by The Register and 404 Media.

The playbooks work because the defenses don’t change fast enough. Companies keep deploying Salesforce with default permissions. Employees keep answering vishing calls. Third-party integrations keep getting excessive OAuth scopes. Until those fundamentals shift, ShinyHunters (or the next group to copy their methods) will keep filling the breach tracker.

We’ll update this page as new breaches are confirmed. Bookmark it. Check back.

Sources

1. Wikipedia: “ShinyHunters” (accessed May 2026)
2. Google Cloud Threat Intelligence: “Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft” (2026)
3. Push Security: “How Three Techniques Are Behind ShinyHunters’ 2026 Campaigns” (2026)
4. Salesforce Ben: “ShinyHunters Breach 400 Companies via Salesforce Experience Cloud” (2026)
5. BleepingComputer: “Carnival Cruise Confirms Data Breach Affecting Nearly 6 Million People” (May 2026)
6. Bitdefender: “FBI Warns Students and Staff That ShinyHunters May Come Knocking After Canvas Breach” (May 2026)
7. The Register: “ShinyHunters Demands $1.5M Not to Leak Wynn Resorts Data” (February 2026)
8. The Register: “ShinyHunters Adds Charter to Trophy Shelf After 4.9M Customer Records Leak” (May 2026)
9. BleepingComputer: “ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks” (2025)
10. FBI Internet Crime Complaint Center: “ShinyHunters: Cyber Criminal Group Attacks Learning Management System” (Public Service Announcement I-051526-PSA, May 15, 2026)
11. The Register, Jessica Lyons: “ShinyHunters tells The Reg: We hacked the FBI to ‘protect our business’” (September 25, 2026)
12. 404 Media, Joseph Cox: “FBI Hack Exposed FBI’s Own Hacking Unit” (September 23, 2026)
13. 404 Media, Joseph Cox: “‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees” (September 22, 2026)
14. The Register, Jessica Lyons: “ShinyHunters claims FBI hack: ‘This is NOT financially motivated’” (September 22, 2026)

Related Coverage

• Canvas LMS Breach: ShinyHunters Claims 275 Million Students
• Instructure Paid the Ransom: The Canvas Settlement
• One Employee Click, 6 Million Passports: Carnival’s Breach
• ShinyHunters Hit 400+ Companies Through Salesforce
• ShinyHunters’ SSO Campaign Hits 100+ Companies
• Rockstar Games Breach: The Anodot Supply Chain Attack
• ShinyHunters February 2026: Are You Affected? Protection Guide
• TransUnion Breach Exposes 4.4 Million SSNs: ShinyHunters Strike Again
• ShinyHunters’ 2026 Playbook: Find the Vendor, Exploit the Integration
• Every Ransom Payment Funds the Next Attack: ShinyHunters’ 2026 Campaign Economics
• The Vendor Breach Assembly Line: ShinyHunters Industrializes Third-Party Compromise
• Weekly Surveillance Roundup, Sept 21 to 27, 2026: ShinyHunters FBI. The September 22 reporting on the 2 to 3 TB FBI breach through an Oracle PeopleSoft zero-day, including the group's own counter-intelligence framing.
• Daily Surveillance Briefing, September 28, 2026. Covers The Register’s September 25 follow-up, the FBI spokesperson’s statement, and 404 Media’s Remote Operations Unit report.