ShinyHunters 2026: The Full Breach Tracker

The Numbers

Since January 2026, ShinyHunters have claimed responsibility for breaching more than 40 organizations. The total haul, by their own count: approximately 1.8 billion records across all documented breaches since the group formed in 2019 ^[1]. The 2026 campaign alone accounts for hundreds of millions of those records.

Some context: the entire U.S. population is 330 million. ShinyHunters have stolen enough records to cover every American, with hundreds of millions to spare. Even accounting for duplicates and inflated claims, the scale is staggering.

And this isn’t some shadowy nation-state operation with unlimited resources. It’s a group that started on Discord, got famous on RaidForums, and runs their extortion portal with the professionalism of a SaaS company. Their ransom emails include itemized lists of stolen data, Bitcoin payment instructions, 72-hour deadlines, and proof-of-theft samples hosted on Limewire ^[2].

Three Playbooks, One Group

Google Threat Intelligence Group tracks ShinyHunters as three linked threat clusters: UNC6661 and UNC6671 handle the initial break-ins, while UNC6240 runs the extortion side ^[2]. The division of labor is telling: this isn’t improvised. It’s industrialized.

Here’s how they get in:

Playbook 1: Voice Phishing + Adversary-in-the-Middle

An attacker calls an employee pretending to be IT support. “We’re rolling out new security compliance.” “Your passkey needs updating.” They direct the target to a lookalike domain (something like company-sso.com or companyinternal.com) that mirrors the real login page. A live operator relays the stolen credentials and MFA codes to the real identity provider in real time, capturing authenticated session tokens ^[3].

This defeats every form of MFA except hardware security keys and passkeys. Push notifications, SMS codes, authenticator apps: all useless when someone is proxying your session live.

Victims hit this way: ADT (5.5M), Panera Bread (5.1M accounts), Match Group (10M+), Harvard University, University of Pennsylvania, Figure Technology (1M), SoundCloud (30M).

Playbook 2: Salesforce Experience Cloud Exploitation

ShinyHunters discovered that hundreds of companies had misconfigured their Salesforce Experience Cloud portals: guest user profiles with API access enabled or overly permissive Organization-Wide Defaults. They weaponized a modified version of AuraInspector, an open-source Salesforce audit tool, to mass-scan for vulnerable configurations ^[4].

In March 2026, Salesforce issued a security advisory. By then, ShinyHunters had already hit approximately 400 companies, including Snowflake, Okta, LastPass, and Salesforce itself ^[4].

Victims hit this way: Canada Life (5.6M), Kemper (13M), McGraw-Hill (13.5M), TransUnion, and hundreds more. A separate ShinyHunters Salesforce campaign, the theft of Salesloft Drift OAuth tokens (tracked as UNC6395), reportedly netted around 1.5 billion records across roughly 760 organizations ^[9].

Playbook 3: OAuth Supply Chain Attacks

The most sophisticated approach. ShinyHunters compromise third-party integrators’ GitHub environments, stealing OAuth tokens and AWS credentials. Those tokens cascade downstream to every organization using the compromised integration ^[3].

The Anodot breach is the template: attackers compromised Anodot’s analytics platform, then used its access to reach Snowflake and BigQuery instances across multiple downstream customers ^[5].

Victims hit this way: Rockstar Games (78.6M), Vimeo (119K), Woflow (affecting DoorDash, Walmart, Uber), Vercel.

The 2026 Breach Tracker

Every confirmed ShinyHunters breach in 2026, ordered by date. This list includes only confirmed incidents. The group has claimed additional victims that haven’t been verified.

This table is updated as new breaches are confirmed. Last updated: May 31, 2026.

Who Are ShinyHunters?

ShinyHunters formed in 2019. The name is a Pokémon reference: shiny hunting means obsessively searching for rare color variants. They started on Discord, built a reputation on the now-seized RaidForums, and have since become one of the most prolific data theft operations in history ^[1].

They’re affiliated with The Com, an international cybercrime network that also includes Scattered Spider and remnants of Lapsus$. The group’s leader operates under the handle “shinycorp” and runs communications via Tutanota and OnionMail ^[2].

Law enforcement has taken some bites:

• May 2022: Sébastien Raoult, a French programmer, was arrested in Morocco and extradited to the U.S.
• January 2024: Raoult was sentenced to three years in prison and ordered to return $5 million.
• June 2025: Matthew D. Lane, 19, of Massachusetts, pled guilty to PowerSchool extortion linked to ShinyHunters operations.
• June 2025: Four ShinyHunters members were arrested across French regions ^[1].

None of it slowed them down. The arrests happened in June 2025. By January 2026, the vishing campaigns were already running. Arresting individual operators in a decentralized network is like pulling weeds: the roots are still in the ground.

The Pattern Nobody’s Fixing

Look at the breach tracker again. Notice what almost every victim has in common: Salesforce.

ShinyHunters didn’t find a zero-day in Salesforce. They didn’t need one. They found something better: misconfigured guest user permissions that gave anonymous API access to customer data, employee SSO credentials harvested over the phone, and third-party OAuth integrations with excessive access scopes ^[3][4].

Google’s Threat Intelligence report was blunt about it: “This activity is not the result of a security vulnerability in vendors’ products or infrastructure. Instead, it continues to highlight the effectiveness of social engineering” ^[2].

Translation: the software isn’t broken. The way companies deploy it is. And fixing configuration isn’t as exciting as buying new security tools, so it doesn’t happen until after the breach.

ShinyHunters also know that post-compromise cleanup is sloppy. Google observed them using a tool called ToogleBox Recall to delete Okta “Security method enrolled” notification emails from victims’ inboxes, hiding the evidence that an attacker’s device had been registered for MFA ^[2]. They used PowerShell to bulk-download from SharePoint and OneDrive. They pivoted from compromised accounts to send secondary phishing emails to cryptocurrency companies. None of this is novel. All of it keeps working.

The Ransom Question

The FBI’s position is clear: don’t pay ShinyHunters. Paying ransoms funds future attacks, provides no guarantee of data deletion, and emboldens further targeting ^[6].

Instructure paid anyway. After 275 million student records were exposed through Canvas, the company reached a settlement with ShinyHunters that included a “shred logs” clause: the attackers agreed to destroy the stolen data. Whether they actually did is unknowable. Whether the data had already been copied, shared, or sold is unknowable. Instructure paid for a promise from criminals.

Carnival hasn’t disclosed whether they paid. Neither have most other victims. The extortion model works precisely because companies face a calculation: the cost of paying ($1.5 million was ShinyHunters’ demand to Wynn Resorts ^[7]) vs. the cost of lawsuits, regulatory fines, and reputational damage. For many companies, paying is cheaper. And ShinyHunters know it.

What to Do Right Now

What Comes Next

ShinyHunters aren’t slowing down. The arrest of four members in France last June didn’t pause operations for a single month. The group has active extortion deadlines running right now: Charter Communications’ deadline was May 27 ^[8]. New victims appear on their leak site weekly.

The playbooks work because the defenses don’t change fast enough. Companies keep deploying Salesforce with default permissions. Employees keep answering vishing calls. Third-party integrations keep getting excessive OAuth scopes. Until those fundamentals shift, ShinyHunters (or the next group to copy their methods) will keep filling the breach tracker.

We’ll update this page as new breaches are confirmed. Bookmark it. Check back. The list will be longer next time you look.

Sources

1. Wikipedia: “ShinyHunters” (accessed May 2026)
2. Google Cloud Threat Intelligence: “Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft” (2026)
3. Push Security: “How Three Techniques Are Behind ShinyHunters’ 2026 Campaigns” (2026)
4. Salesforce Ben: “ShinyHunters Breach 400 Companies via Salesforce Experience Cloud” (2026)
5. BleepingComputer: “Carnival Cruise Confirms Data Breach Affecting Nearly 6 Million People” (May 2026)
6. Bitdefender: “FBI Warns Students and Staff That ShinyHunters May Come Knocking After Canvas Breach” (May 2026)
7. The Register: “ShinyHunters Demands $1.5M Not to Leak Wynn Resorts Data” (February 2026)
8. The Register: “ShinyHunters Adds Charter to Trophy Shelf After 4.9M Customer Records Leak” (May 2026)
9. BleepingComputer: “ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks” (2025)

Related Coverage

• Canvas LMS Breach: ShinyHunters Claims 275 Million Students
• Instructure Paid the Ransom: The Canvas Settlement
• One Employee Click, 6 Million Passports: Carnival’s Breach
• ShinyHunters Hit 400+ Companies Through Salesforce
• ShinyHunters’ SSO Campaign Hits 100+ Companies
• Rockstar Games Breach: The Anodot Supply Chain Attack
• ShinyHunters February 2026: Are You Affected? Protection Guide
• TransUnion Breach Exposes 4.4 Million SSNs: ShinyHunters Strike Again