ShinyHunters 2026: The Full Breach Tracker

The Numbers

Since January 2026, ShinyHunters have claimed responsibility for breaching more than 40 organizations. The 2026 campaign alone accounts for hundreds of millions of those records.

Some context: the entire U.S. population is 330 million. ShinyHunters have stolen enough records to cover every American, with hundreds of millions to spare. Even accounting for duplicates and inflated claims, the scale is staggering.

And this isn’t some shadowy nation-state operation with unlimited resources. It’s a group that runs their extortion portal with the professionalism of a SaaS company. Their ransom emails include itemized lists of stolen data, Bitcoin payment instructions, 72-hour deadlines, and proof-of-theft samples hosted on Limewire ^[2].

Four Playbooks, One Group

Google Threat Intelligence Group tracks ShinyHunters as three linked threat clusters: UNC6661 and UNC6671 handle the initial break-ins, while UNC6240 runs the extortion side ^[2]. The division of labor is telling: this isn’t improvised. It’s industrialized.

Here’s how they get in:

Playbook 1: Voice Phishing + Adversary-in-the-Middle

An attacker calls an employee pretending to be IT support. “We’re rolling out new security compliance.” “Your passkey needs updating.” They direct the target to a lookalike domain (something like company-sso.com or companyinternal.com) that mirrors the real login page. A live operator relays the stolen credentials and MFA codes to the real identity provider in real time, capturing authenticated session tokens ^[3].

This defeats every form of MFA except hardware security keys and passkeys. Push notifications, SMS codes, authenticator apps: all useless when someone is proxying your session live.

Victims hit this way: ADT (5.5M), Panera Bread (5.1M accounts), Match Group (10M+), Harvard University, University of Pennsylvania, Figure Technology (1M), SoundCloud (30M).

Playbook 2: Salesforce Experience Cloud Exploitation

ShinyHunters discovered that hundreds of companies had misconfigured their Salesforce Experience Cloud portals: guest user profiles with API access enabled or overly permissive Organization-Wide Defaults. They weaponized a modified version of AuraInspector, an open-source Salesforce audit tool, to mass-scan for vulnerable configurations ^[4].

In March 2026, Salesforce issued a security advisory. By then, ShinyHunters had already hit approximately 400 companies ^[4].

Victims hit this way: Canada Life (5.6M), Kemper (13M), McGraw-Hill (13.5M), TransUnion, and hundreds more. A separate ShinyHunters Salesforce campaign, the theft of Salesloft Drift OAuth tokens (tracked as UNC6395), reportedly netted around 1.5 billion records across roughly 760 organizations ^[9].

Playbook 3: OAuth Supply Chain Attacks

The most sophisticated approach. ShinyHunters compromise third-party integrators’ GitHub environments, stealing OAuth tokens and AWS credentials. Those tokens cascade downstream to every organization using the compromised integration ^[3].

The Anodot breach is the template: attackers compromised Anodot’s analytics platform, then used its access to reach Snowflake and BigQuery instances across multiple downstream customers ^[3].

Victims hit this way: Rockstar Games (78.6M), Vimeo (119K), Woflow (affecting DoorDash, Walmart, Uber), Vercel.

Playbook 4: Zero-Day Exploitation (Oracle PeopleSoft)

A fourth technique surfaced in late May 2026. Google Threat Intelligence Group and Mandiant tracked ShinyHunters (designation UNC6240) exploiting a then-unpatched critical remote code execution vulnerability in the Environment Management component of Oracle PeopleSoft, tracked as CVE-2026-35273 (CVSS 9.8). Active exploitation ran from roughly May 27 through June 9, 2026, and predates Oracle’s June 10, 2026 advisory ^[10].

The campaign fell heavily on higher education. Google says it notified over 100 global organizations whose IP addresses correlated with potentially vulnerable endpoints, most of them in the United States, and that 68 percent of those organizations were academic institutions. Several blocked or remediated the activity; others were compromised, and stolen data was published on the group’s leak site on June 9, 2026. Google’s write-up does not name individual victims ^[10].

This is the first time the 2026 campaign has used a software vulnerability rather than social engineering for initial access. It does not change the social-engineering baseline, but it shows ShinyHunters can add zero-days to the toolkit when targets harden the doors.

The 2026 Breach Tracker

Every confirmed ShinyHunters breach in 2026, ordered by date. This list includes only confirmed incidents. The group has claimed additional victims that haven’t been verified.

This table is updated as new breaches are confirmed. Last updated: August 25, 2026.

Who Are ShinyHunters?

ShinyHunters formed in 2019. The name is a Pokémon reference: shiny hunting means obsessively searching for rare color variants. They have since become one of the most prolific data theft operations in history ^[1].

Law enforcement has taken some bites:

• June 2025: Four ShinyHunters members were arrested across French regions ^[1].

None of it slowed them down. The arrests happened in June 2025. By January 2026, the vishing campaigns were already running. Arresting individual operators in a decentralized network is like pulling weeds: the roots are still in the ground.

The Pattern Nobody’s Fixing

Look at the breach tracker again. Notice what almost every victim has in common: Salesforce.

ShinyHunters didn’t find a zero-day in Salesforce. They didn’t need one. They found something better: misconfigured guest user permissions that gave anonymous API access to customer data, employee SSO credentials harvested over the phone, and third-party OAuth integrations with excessive access scopes ^[3][4].

Google’s Threat Intelligence report was blunt about it: “This activity is not the result of a security vulnerability in vendors’ products or infrastructure. Instead, it continues to highlight the effectiveness of social engineering” ^[2].

Translation: the software isn’t broken. The way companies deploy it is. And fixing configuration isn’t as exciting as buying new security tools, so it doesn’t happen until after the breach.

ShinyHunters also know that post-compromise cleanup is sloppy. Google observed them using a tool called ToogleBox Recall to delete Okta “Security method enrolled” notification emails from victims’ inboxes, hiding the evidence that an attacker’s device had been registered for MFA ^[2]. They used PowerShell to bulk-download from SharePoint and OneDrive. They pivoted from compromised accounts to send secondary phishing emails to cryptocurrency companies. None of this is novel. All of it keeps working.

The Ransom Question

The FBI’s position is clear: don’t pay ShinyHunters. Paying ransoms funds future attacks, provides no guarantee of data deletion, and emboldens further targeting ^[6].

Instructure paid anyway. After 275 million student records were exposed through Canvas, the company reached a settlement with ShinyHunters that included a “shred logs” clause: the attackers agreed to destroy the stolen data. Whether they actually did is unknowable. Whether the data had already been copied, shared, or sold is unknowable. Instructure paid for a promise from criminals.

Carnival hasn’t disclosed whether they paid. Neither have most other victims. The extortion model works precisely because companies face a calculation: the cost of paying ($1.5 million was ShinyHunters’ demand to Wynn Resorts ^[7]) vs. the cost of lawsuits, regulatory fines, and reputational damage. For many companies, paying is cheaper. And ShinyHunters know it.

What to Do Right Now

What Comes Next

ShinyHunters aren’t slowing down. The arrest of four members in France last June didn’t pause operations for a single month. The group has active extortion deadlines running right now: Charter Communications’ deadline was May 27 ^[8]. New victims appear on their leak site weekly.

The playbooks work because the defenses don’t change fast enough. Companies keep deploying Salesforce with default permissions. Employees keep answering vishing calls. Third-party integrations keep getting excessive OAuth scopes. Until those fundamentals shift, ShinyHunters (or the next group to copy their methods) will keep filling the breach tracker.

Between late May and early August 2026 the group added a fourth tool to the kit: a true software zero-day. CVE-2026-35273 (a critical remote code execution vulnerability in the Environment Management component of Oracle PeopleSoft, CVSS 9.8) was exploited in the wild as a zero-day before Oracle’s June 10, 2026 advisory. Google notified over 100 global organizations whose IP addresses correlated with potentially vulnerable endpoints, 68 percent of them academic institutions, and did not name individual victims ^[10]. RingCentral disclosed a separate vishing-driven breach on July 28 after the group posted what it claimed was 623 GB of data; roughly 1.6 million unique email addresses tied to RingCentral, alongside names, physical addresses and phone numbers, were reported leaked as of August 14 according to Have I Been Pwned, after the group set a July 30 payment deadline and posted again on August 3 ^[11]. Baxter International confirmed “unauthorized activity involving certain third-party applications” on August 13; ShinyHunters listed Baxter the next day and claimed the incident touched its Salesforce environment at roughly 7.1 million records, a figure Baxter has not verified ^[12][13].

We’ll update this page as new breaches are confirmed. Bookmark it. Check back. The list will be longer next time you look.

Sources

1. Wikipedia: “ShinyHunters” (accessed May 2026)
2. Google Cloud Threat Intelligence: “Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft” (2026)
3. Push Security: “How Three Techniques Are Behind ShinyHunters’ 2026 Campaigns” (2026)
4. Salesforce Ben: “ShinyHunters Breach 400 Companies via Salesforce Experience Cloud” (2026)
5. BleepingComputer: “Carnival Cruise Confirms Data Breach Affecting Nearly 6 Million People” (May 2026)
6. Bitdefender: “FBI Warns Students and Staff That ShinyHunters May Come Knocking After Canvas Breach” (May 2026)
7. The Register: “ShinyHunters Demands $1.5M Not to Leak Wynn Resorts Data” (February 2026)
8. The Register: “ShinyHunters Adds Charter to Trophy Shelf After 4.9M Customer Records Leak” (May 2026)
9. BleepingComputer: “ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks” (2025)
10. Google Cloud Threat Intelligence: “ShinyHunters Targets Education Sector with Oracle Exploit” (June 2026)
11. The Register: “1.6M RingCentral accounts’ data dumped after ShinyHunters extortion attack” (August 14, 2026)
12. Baxter International: “Statement Regarding Cybersecurity Incident” (August 13, 2026)
13. MedDeviceCyber: “ShinyHunters lists Baxter, claims 7.1 million Salesforce records” (August 14, 2026)

Related Coverage

• Canvas LMS Breach: ShinyHunters Claims 275 Million Students
• Canvas Ransom Deadline May 6: School Districts Respond
• ShinyHunters Hacked Instructure Twice: The May 12 Deadline
• Instructure Paid the Ransom: The Canvas Settlement
• One Employee Click, 6 Million Passports: Carnival’s Breach
• Carnival Breached Again: 8.7 Million Records Claimed
• Two Ransomware Gangs Hit Cushman & Wakefield in the Same Week
• ShinyHunters Dumped 50GB of Cushman & Wakefield Data
• Figure Technology Breach: ShinyHunters’ Okta Hit
• Figure Breach Exposes 967,000 Users
• ShinyHunters Hit 400+ Companies Through Salesforce
• ShinyHunters’ SSO Campaign Hits 100+ Companies
• Rockstar Games Breach: The Anodot Supply Chain Attack
• ShinyHunters February 2026: Are You Affected? Protection Guide
• TransUnion Breach Exposes 4.4 Million SSNs: ShinyHunters Strike Again
• ShinyHunters’ 2026 Playbook: The Vendor Is the Front Door
• Every Ransom Payment Funds the Next Attack
• The Vendor Breach Assembly Line