ShinyHunters 2026 Tracker: Every Victim, Every Method

A voice-phishing driven extortion crew that pivots through Okta and Salesforce. Google tracks the operation across three clusters. The FBI says 140+ organizations breached and at least $70 million in extortion since 2025.

State of Surveillance

TL;DR: ShinyHunters is a voice-phishing-driven extortion operation that hijacks Okta and Salesforce tenants and publishes stolen data when victims refuse to pay. Google's Threat Intelligence Group (GTIG) tracks the 2026 wave across three clusters: UNC6661, UNC6671, and UNC6240.[1] Dutch police arrested a suspected member, a 24-year-old from Amsterdam, on September 15, 2026; FBI Director Kash Patel posted about it without naming the individual.[2] FBI Cyber Division Assistant Director Brett Leatherman said in a video statement: "Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments."[2] In January 2024, French hacker Sébastien Raoult (alias "Sezyo Kaizen") was sentenced to three years in U.S. federal prison and ordered to pay $5 million in restitution for his role in the earlier ShinyHunters wave that hit more than 60 companies.[3] This page tracks the public record on the group through mid-October 2026.

What ShinyHunters Actually Is

ShinyHunters is a brand name that has been attached to several distinct waves of breach-and-extortion activity since 2020. ReliaQuest, writing in September 2025, describes the actor as resurfacing "with a wave of attacks on Salesforce, targeting high-profile companies across various sectors," after a year of relative quiet following the 2024 arrests of four alleged members.[4] The group is tracked under multiple vendor labels (ShinyHunters, Sp1d3rHunters, and sometimes "SLSH" or "ShinySp1d3r" when referring to a broader umbrella that also includes Scattered Spider and Lapsus$).

The 2026 wave runs through three activity clusters that Google publicly tracks: UNC6661, UNC6671, and UNC6240. UNC6661 and UNC6671 are the vishing-and-SaaS-pivot operators; GTIG attributes the extortion activity that follows UNC6661 intrusions to UNC6240, based on overlaps including a shared Tox account for negotiations and Limewire hosting of stolen-data samples.[1] The cluster IDs UNC6040 and UNC6395, often cited in earlier 2025 reporting on the same operation, are not named in GTIG's January 30, 2026 writeup.[1]

The "Scattered Spider" connection is the part defenders and journalists argue about. ReliaQuest described "Sp1d3rhunters" telling DataBreaches on Telegram that the two groups "are the same" and "have always been the same."[4] Whether that is true, partial overlap, or aspirational brand-washing is not settled in any court filing, and the operation uses different handles, personas, and cluster IDs across its sub-teams. Treat the two as overlapping ecosystems, not synonyms.

Known Victims

This list covers publicly reported victims confirmed by the victims themselves, court records, or named primary sources. ShinyHunters' own leak-site claims do not appear unless another outlet or a court filing corroborates them.

Bonobos, Pixlr, Microsoft's GitHub, AT&T (2020 to 2021)

The Record's coverage of Raoult's January 10, 2024 sentencing lists the named 2020 to 2021 victims as "Bonobos," "Pixlr," "Microsoft's GitHub account," and an "AT&T" claim of "70 million user accounts" that AT&T denied.[3] The court found the campaign overall hit "more than 60 companies" and stole "hundreds of millions of customer records" with estimated losses of "$6 million."[3]

Tokopedia (2020)

ReliaQuest's threat spotlight credits 2020: "ShinyHunters first gained notoriety by advertising 91 million Tokopedia user records for sale on 'Empire Market' in 2020."[4]

PowerSchool (December 2024)

ReliaQuest identifies December 2024 as the month ShinyHunters "alleged attack on education software PowerSchool" took place, marking the breach that pulled the group out of its post-arrest quiet period.[4] The wider 2024 to 2025 Salesforce-via-Snowflake wave that included Ticketmaster, Santander, AT&T, and Neiman Marcus is separately documented; the Snowflake-customer-side intrusions were carried out by a related cluster tracked in different industry advisories.

Louis Vuitton (July 2, 2025)

ReliaQuest: "Louis Vuitton reportedly became aware of a data breach on July 2, 2025."[4] The ReliaQuest writeup adds that Louis Vuitton had not confirmed ShinyHunters was responsible as of its September 15, 2025 publication.[4] Domain registrations tied to this wave include ticket-lvmh[.]com, ticket-dior[.]com, ticket-louisvuitton[.]com, ticket-nike[.]com (registered June 26, 2025), and ticket-audemarspiguet[.]com (registered June 20, 2025).[4]

Crunchbase, SoundCloud, Betterment (January 2026 vishing)

SOC Radar's January 23, 2026 writeup of Okta threat intelligence links the 2026 ShinyHunters-branded Okta vishing operation to three organizations: "Crunchbase, SoundCloud, and Betterment."[5] SOC Radar reports "over 20 million records linked to Betterment," "over 2 million records linked to Crunchbase," and "over 30 million records linked to SoundCloud."[5]

FBI Jobs Website (September 2026)

CBS News reports that on September 22, 2026 "404 Media" first reported ShinyHunters "claimed responsibility for last week's defacing of the FBI's jobs website."[2] The attackers are reported to have "used a new vulnerability in Oracle PeopleSoft, a human resources management program," and to have "stole two to three terabytes of data related to FBI and Justice Department workers."[2] CBS summarizes the breach as covering data that "possessed sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs," and lists "criminal justice, human resources and Medlink systems among the services that were affected."[2]

What the FBI has publicly tallied

Brett Leatherman, FBI Cyber Division Assistant Director, said in a video statement after the September 15, 2026 Dutch arrest: "Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments."[2] The same statement adds that they "often target third-party vendors and cloud-based platforms, stealing sensitive data and extorting victims with threats to publishing."[2]

The Playbook: How ShinyHunters Gets In

The 2026 wave runs on three consistent techniques, all documented in primary GTIG, SOC Radar, and Obsidian reporting.

  • Voice phishing ("vishing") of IT help desks. GTIG: "UNC6661 pretended to be IT staff and called employees at targeted victim organizations claiming that the company was updating MFA settings."[1] The same report says these operations run on voice phishing and victim-branded credential harvesting sites to gain initial access by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes.[1] UNC6671 "conducted vishing operations masquerading as IT staff and directing victims to enter their credentials and MFA authentication codes on a victim-branded credential harvesting site."[1]
  • Brand-lookalike phishing domains. GTIG: "The credential harvesting domains attributed to UNC6661 commonly, but not exclusively, use the format sso.com or internal.com and have often been registered with NICENIC."[1] UNC6671 "domains used the same structure as UNC6661, but were more often registered using Tucows."[1]
  • Okta FastPass enrollment via emulated Android. Obsidian Security describes the MFA bypass: "MFA persistence through Okta FastPass enrollment, frequently using emulated Android devices."[6] The user agent that flags the emulation: "com.okta.android.auth/8.19.0 ... Android/16 ... Genymobile/Phone."[6] Obsidian's analysis: "Genymobile is associated with Android emulation, making this artifact a potentially valuable detection signal when correlated with suspicious authentication activity."[6]
  • ToogleBox Recall abuse to cover tracks. GTIG: "In at least one incident where the threat actor gained access to an Okta customer account, UNC6661 enabled the ToogleBox Recall add-on for the victim's Google Workspace account, a tool designed to search for and permanently delete emails. They then deleted a 'Security method enrolled' email from Okta, almost certainly to prevent the employee from identifying that their account was associated with a new MFA device."[1]
  • Search-and-exfiltrate inside SaaS apps. GTIG: "the threat actors have conducted searches in cloud applications for documents containing specific text including 'poc,' 'confidential,' 'internal,' 'proposal,' 'salesforce,' and 'vpn' or targeted personally identifiable information (PII) stored in Salesforce."[1] UNC6671 "leveraged PowerShell to download sensitive data from SharePoint and OneDrive."[1]
  • Compromised inboxes become phishing relays. GTIG: "In at least one case, after conducting the initial data theft, UNC6661 used their newly obtained access to compromised email accounts to send additional phishing emails to contacts at cryptocurrency-focused companies. The threat actor then deleted the outbound emails, likely in an attempt to obfuscate their malicious activity."[1]
  • 72-hour extortion deadline with public shaming. GTIG on UNC6240: "In mid-January 2026 extortion emails, UNC6240 outlined what data they allegedly stole, specifying a payment amount and destination BTC address, and threatening consequences if the ransom was not paid within 72 hours."[1] GTIG also notes "extortion text messages sent to employees and received reports of victim websites being targeted with distributed denial-of-service (DDoS) attacks."[1]
  • Commercial VPN and residential proxy anonymization. GTIG: "Many of the network indicators identified in this campaign are associated with commercial VPN services or residential proxy networks, including Mullvad, Oxylabs, NetNut, 9Proxy, Infatica, and nsocks."[1]
  • Sector rotation. ReliaQuest's mid-2025 review: "April to May 2025: Retail trade. June to July: Insurance. June to August: Aviation."[4] "Since July 2025, domain registrations targeting financial companies have increased by 12%, while targeting of technology firms has decreased by 5%."[4]

The single most consistent lesson is the front door. The attacker talks a human out of an MFA code, then enrolls an attacker-controlled device, then erases the email evidence of that enrollment, then walks into Salesforce, SharePoint, OneDrive, and Slack as that user. Phishing-resistant MFA (FIDO passkeys, Okta FastPass on a real device, certificate-based auth) breaks the chain because the attacker cannot relay a cryptographic challenge that is bound to the legitimate origin. SOC Radar's Okta recommendations restate this: "Enforcing phishing-resistant authentication such as passkeys or FastPass; Restricting access based on network zones and known IP ranges; Blocking authentication attempts from anonymization services; Increasing employee awareness of phone-based social engineering tactics."[5]

What You Can Do If ShinyHunters Is A Threat To You

Your direct risk depends on whether you or your employer uses Salesforce, Okta, Microsoft 365, Google Workspace, SharePoint, OneDrive, or Slack. Different ShinyHunters subscriptions attack different worlds.

  • If you run an IT help desk that takes phone calls for password resets: this is the front door. GTIG's UNC6661 and UNC6671 both run on this vector.[1] SOC Radar's first listed mitigation is "Increasing employee awareness of phone-based social engineering tactics."[5] Add a video or in-person verification step before any MFA factor change, and require manager co-approval for new device enrollments.
  • If you operate Okta, Microsoft 365, Google Workspace, or any SSO: enforce phishing-resistant MFA on every admin and every help-desk user. FIDO passkeys and Okta FastPass on a real, corporate-managed device beat any push notification or one-time code.[5][6] Watch for the Genymobile user agent (per Obsidian) and the ToogleBox Recall activation (per GTIG).[1][6] Block authentication from anonymization services: GTIG names Mullvad, Oxylabs, NetNut, 9Proxy, Infatica, and nsocks as observed infrastructure.[1]
  • If you operate Salesforce or SharePoint: GTIG documents targeted in-app searches for "poc," "confidential," "internal," "proposal," "salesforce," "vpn," and stored PII.[1] Enable Salesforce Event Monitoring and SharePoint audit logs; alert on bulk download or on ToogleBox Recall activation in Google Workspace.
  • If you run an HR system on Oracle PeopleSoft: the September 2026 FBIJobs.gov breach used a new PeopleSoft vulnerability to exfiltrate HR data.[2] Apply Oracle's quarterly CPU and any out-of-band PeopleSoft patch immediately; treat the PeopleSoft admin console like an internet-exposed identity provider.
  • If your data was already posted to a leak site: do not pay to keep it off the internet. SOC Radar's writeup notes the group's pattern: "After failed extortion attempts, the group published alleged victim data on their Data Leak Site (DLS)."[5] Treat the data as compromised: rotate credentials, issue new MFA factors on a clean device, monitor the listed record types for credential stuffing, and notify the regulator and affected customers.
  • If you have credible information on the operation: the FBI is investigating. The contact page on fbi.gov points to tips.fbi.gov and the Internet Crime Complaint Center at ic3.gov. The State Department's Rewards for Justice program offers payments for information on major cyber actors; the specific dollar amounts for ShinyHunters tips are not publicly listed as of October 15, 2026.

If you are an IT or security lead at an organization that uses any of the affected SaaS platforms, the single highest-impact change is to map your external attack surface against the GTIG January 30, 2026 detection guidance (UNC6661 and UNC6671 vishing patterns, ToogleBox Recall, Genymobile user agent, commercial VPN and residential proxy IPs) before the next inbound call to your help desk. The second highest-impact change is to enforce phishing-resistant MFA on every admin portal, every help-desk user, and every employee who can see customer data, in line with SOC Radar's Okta recommendations.[5]

The Honest Takeaway

ShinyHunters is not one gang and not one playbook. It is a brand applied to several waves of breach-and-extortion activity since 2020, with the 2026 wave running on Okta-and-Salesforce vishing run by GTIG-tracked clusters UNC6661, UNC6671, and UNC6240.[1] The earlier 2020 to 2021 wave ended with Sébastien Raoult's January 10, 2024 sentence of three years in federal prison and $5 million in restitution for hits on "more than 60 companies."[3] The 2025 wave hit Louis Vuitton, Salesforce instances reachable through Salesloft/Drift and Gainsight integrations, and dozens of other SaaS tenants; ReliaQuest documented the sector rotation from retail to insurance to aviation and back to finance.[4]

The FBI's public framing is the clearest data point. Brett Leatherman's video statement: "Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments."[2] The dollar-per-victim number is small compared to a single crypto-exchange heist, but the volume is what makes this operation notable. The business model mirrors ransomware crews without the encryption step: pure extortion over stolen data.

What does not change is the front door. The 2026 attacker talks a human out of an MFA code, then enrolls an attacker-controlled device, then erases the email evidence of that enrollment, then walks into Salesforce, SharePoint, OneDrive, and Slack as that user.[1][6] GTIG's UNC6661 has even been observed using compromised email accounts to send additional phishing emails "to contacts at cryptocurrency-focused companies" before deleting the outbound emails "to obfuscate their malicious activity."[1] Phishing-resistant MFA (FIDO passkeys, Okta FastPass on a real device, certificate-based auth) breaks the chain at the front door.

The sources on this page cover ShinyHunters activity documented in Google Threat Intelligence Group, Okta-sourced SOC Radar reporting, ReliaQuest threat spotting, Obsidian Security incident analysis, The Record's court coverage of Raoult's January 2024 sentencing, and CBS News' reporting on the September 2026 FBI and Dutch actions. It is not a complete victim list; the group's full footprint, including Salesforce-via-Salesloft/Drift and Gainsight compromise casualties confirmed by the victims, includes victims that require their own research.

Sources

  1. Google Threat Intelligence Group, Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft (January 30, 2026)
  2. CBS News, Dutch National Police arrest member of group that claimed to have hacked FBI (September 29, 2026)
  3. The Record, French hacker Sébastien Raoult of ShinyHunters sentenced in U.S. federal court (January 10, 2024)
  4. ReliaQuest, ShinyHunters Targets Salesforce Amid Clues of Scattered Spider Collaboration (September 15, 2025)
  5. SOC Radar, Okta Vishing Campaign Allegedly Linked to ShinyHunters (January 23, 2026)
  6. Obsidian Security, Behind the breach: ShinyHunters' 2026 voice phishing campaign (March 11, 2026; updated September 7, 2026)

Published: October 15, 2026