#ShinyHunters
All CosmicBytez Labs articles tagged #ShinyHunters, across news, security advisories, how-to guides, and projects.
- News
When Your Ransomware Negotiator Works for the Other Side
Dark Reading's analysis of negotiator Edward Dubrovsky's arrest warns crisis urgency lets compromised IR vendors bypass normal vetting controls.
- News
UK Legal Aid Agency: Hackers Stole Records Dating Back to 1978
The UK's Legal Aid Agency says records stolen in an April 2025 breach span back to 1978, with roughly 250,000 pre-2007 records confirmed by investigators.
- News
Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, 54, a prominent Cypfer-linked ransomware negotiator, was arrested in Pennsylvania and charged with conspiracy to extort money.
- News
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested in Pennsylvania on extortion charges amid the FBI's ShinyHunters breach probe.
- News
Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
This week: Zammad helpdesk 0-days hit a Dutch nonprofit, rogue certs from hijacked ccTLDs, a third ShinyHunters arrest, and AI-evading malware.
- News
Canadian Cybersecurity Executive Arrested in Federal Extortion Case Tied to ShinyHunters Probe
CYPFER co-founder Edward Dubrovsky, 54, was arrested on federal extortion charges as prosecutors probe ShinyHunters' breach of FBI systems.
- News
Cyber Exec Arrested in Case Allegedly Tied to ShinyHunters Hackers
Canadian cybersecurity exec Edward Dubrovsky, a CYPFER co-founder, was arrested on extortion charges multiple outlets link to the FBI's ShinyHunters probe.
- News
FBI Arrests Another Suspected ShinyHunters Hacker After Agency Breach
FBI Director Kash Patel announced a third arrest tied to ShinyHunters' breach of the bureau's own FBIjobs.gov site.
- News
FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe
Krebs identifies the previously unnamed Pennsylvania arrestee as Cypfer co-founder Edward Dubrovsky, accused of aiding ShinyHunters.
- News
FBI Blames Contractor's Missed Patch for ShinyHunters Breach of Employee Data
The FBI says an Accenture contractor's failure to patch an Oracle PeopleSoft system let ShinyHunters steal employee personal data.
- News
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The FBI fired an Accenture contractor who skipped a required patch, letting ShinyHunters breach its jobs portal via an Oracle PeopleSoft flaw.
- News
Alleged ShinyHunters Member Reportedly Detained in Jordan, Assisting FBI
Saif al-Din Khader, allegedly a top ShinyHunters figure, was detained in Jordan and is reportedly assisting the FBI after the group's FBI data-breach claims.
- News
Dutch Police Arrest 'Reformed' Hacker in ShinyHunters Investigation
Dutch police arrested a 24-year-old convicted hacker tied to ShinyHunters, and the group then breached the FBI's job site and extorted Cl0p.
- News
ShinyHunters Suspect 'Rey' Reportedly Detained in Jordan, Helping FBI Identify Group Members
Suspected ShinyHunters member Saif al-Din Khader ('Rey') was detained in Jordan and is reportedly helping the FBI identify other group members, sources say.
- News
ShinyHunters Hacker Reportedly Detained in Jordan, Aiding FBI
ShinyHunters member "Rey" was reportedly detained in Jordan on Oct. 1 and is cooperating with the FBI to identify other members of the group.
- News
Alleged ShinyHunters Leader Arrested in the Netherlands
Dutch police arrested a 24-year-old Amsterdam man tied to ShinyHunters on Sept. 15 — a week before the group claimed to hack the FBI.
- News
ShinyHunters Trades Financial Extortion for a Reckless War of Ego With the FBI
ShinyHunters skips its usual ransom demand, instead threatening the FBI to retract a report — alarming experts who warn agent and family safety is at risk.
- News
ShinyHunters Bypass WAFs to Exploit Oracle PeopleSoft Flaw at Scale
Google warns ShinyHunters is mass-exploiting a patched PeopleSoft RCE flaw again, using URL-encoding to slip requests past WAFs.
- News
ShinyHunters Bypasses WAF Rules to Revive Oracle PeopleSoft Attacks
Google says ShinyHunters (UNC6240) resumed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273 by URL-encoding a single character past WAF rules.
- News
ShinyHunters Hacked Clop's Leak Site Using a Grav CMS Path Traversal Flaw
ShinyHunters defaced Clop's Tor leak site via an unauthenticated Grav CMS flaw, claims stolen data and onion keys, and is extorting the gang for eight figures.
- News
FBI Investigating Alleged ShinyHunters Breach of Its Jobs Site
ShinyHunters defaced the FBI's jobs site and claims to hold data on nearly all FBI agents and applicants; the FBI says it is investigating.
- News
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
ShinyHunters claims it breached FBI systems via an Oracle PeopleSoft flaw, stealing 2-3TB of data on agents, applicants, and Director Patel.
- News
ShinyHunters Hijacks Cl0p's Ransomware Leak Site, Demands Extortion Payment
ShinyHunters seized Cl0p's dark web leak site, defaced it, and is demanding an eight-figure payment plus a public apology.
- News
ShinyHunters Hacks Clop Leak Site, Threatens to Extort Ransomware Gang
ShinyHunters defaced Clop's Tor leak site and claims to have stolen its onion service private keys, threatening to extort the ransomware gang.
- News
Florida DMV Data Breach Tied to ShinyHunters Traced to Officer's Personal Device
ShinyHunters breached Florida's motor vehicle department after exploiting a police officer's credentials stored on a personal device.
- News
Passkey-Themed Phishing Attacks Lead to Microsoft 365 Data Theft
ShinyHunters and Helix affiliates use fake passkey/help-desk lures with AiTM and device-code phishing to steal Microsoft 365 data.
- News
Florida Confirms DMV Database Breached via Stolen Police Account
FLHSMV confirms its DAVID driver database was breached using credentials stolen from an officer's personal device, as ShinyHunters claims 200,000+ records.
- News
AdaptHealth Confirms 4.1 Million People Exposed in ShinyHunters-Linked Breach
A contractor phishing attack gave attackers cloud access at AdaptHealth, exposing patient records for 4.1 million people in a ShinyHunters intrusion.
- News
McKesson Confirms Data Breach as ShinyHunters' Deadline Looms
McKesson confirms unauthorized access to two business units after ShinyHunters claims 284 million records and demands ~$55M by Sept 1.
- News
ReliaQuest Confirms Failed Data-Theft Attack After ShinyHunters Employee Impersonation
ReliaQuest disclosed a social engineering attack where ShinyHunters impersonated an employee to steal data — the attempt was detected and blocked.
- News
ShinyHunters Claims Brinks Home Breach, Threatens to Leak Stolen Data
Notorious threat actor ShinyHunters claims to have breached residential security company Brinks Home, threatening to publicly release sensitive customer...
- News
Ernst & Young Data Breach Claimed by ShinyHunters Extortion Gang
The ShinyHunters extortion group has claimed responsibility for a supply chain attack against Ernst & Young, alleging access to the Big Four firm's Jira,...
- News
ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam
Threat actors are leveraging email addresses exposed in ShinyHunters data breaches to send highly personalized sextortion emails demanding $2,000 in...
- News
Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
Microsoft has detailed three distinct attack paths used by actors aligned with ShinyHunters to infiltrate corporate Salesforce environments over the past...
- News
Medtronic Breach Hits 3.8 Million: SSNs and Health Data Exposed
Medtronic, the world's largest medical device maker, has notified nearly 3.8 million people after a breach linked to ShinyHunters exposed Social Security...
- News
Medtronic Notifies Customers Impacted by ShinyHunters Data Breach
Healthcare device giant Medtronic is sending breach notification letters to customers after ShinyHunters gained unauthorized access to personal data held...
- News
NAIC Says Only Public Data Stolen in ShinyHunters PeopleSoft Breach
The National Association of Insurance Commissioners confirms ShinyHunters exploited an Oracle PeopleSoft zero-day but says only publicly available data,...
- News
Nissan Discloses Employee Data Breach Linked to Oracle Zero-Day Attacks
Nissan warns that current and former employees had data stolen after threat actors exploited an Oracle PeopleSoft zero-day vulnerability tied to the...
- News
Kodak Admits Data Breach After ShinyHunters Hack Claims
Eastman Kodak has confirmed a cybersecurity incident following claims by the prolific ShinyHunters threat actor, though the company says it believes there...
- News
Council of Europe Investigates ShinyHunters Data Breach Claims
The Council of Europe, Europe's oldest intergovernmental body, is probing data breach claims made by the ShinyHunters extortion group, which claimed...
- News
Infinite Campus Data Breach Affects 137,000 School Staff Accounts
The ShinyHunters extortion gang stole personal information from over 137,000 school staff accounts via a Salesforce data theft attack targeting the widely...
- News
Google Confirms ShinyHunters Exploited Oracle PeopleSoft Zero-Day CVE-2026-35273
Google's Threat Intelligence Group confirmed in-the-wild exploitation of Oracle PeopleSoft zero-day CVE-2026-35273 by ShinyHunters, even as Oracle...
- News
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Education
The ShinyHunters hacking group exploited a critical Oracle PeopleSoft ERP zero-day (CVE-2026-35273) that disproportionately impacted American...
- News
Oracle Mitigates PeopleSoft Zero-Day Exploited in Data Theft Attacks
Oracle has issued an emergency mitigation for CVE-2026-35273, a critical unauthenticated RCE flaw in PeopleSoft Suite being actively exploited by the...
- News
ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach Universities
The ShinyHunters group, tracked by Mandiant as UNC6240, has been exploiting CVE-2026-35273 in Oracle PeopleSoft to breach universities and higher...
- News
Hackers Leak DentaQuest Information Impacting 2.6 Million
The ShinyHunters extortion group has leaked approximately 234 GB of data allegedly stolen from DentaQuest, a major dental benefits administrator serving…
- News
Charter Communications Data Breach Affects 4.9 Million Accounts
ShinyHunters stole personal information from 4.9 million Charter Communications accounts in an April 2026 hack, confirmed via Have I Been Pwned.
- News
Carnival Cruise Confirms Data Breach Affecting Nearly 6 Million People
Carnival Corporation, the world's largest cruise operator, confirms a breach affecting nearly 6M people after ShinyHunters' April 2026 extortion claim.
- News
185,000 Likely Impacted by 7-Eleven Data Breach
ShinyHunters has leaked data allegedly stolen from 7-Eleven containing email addresses, names, physical addresses, and dates of birth for approximately 185,000.
- News
7-Eleven Data Breach Exposes Personal Information of 185,000 People
The ShinyHunters extortion gang stole the personal information of over 185,000 customers after breaching convenience store giant 7-Eleven in April 2026, with.
- Newsletter
May 26 Digest: SharePoint RCE, Megalodon CI/CD Blitz
Microsoft patches a CVSS 8.8 SharePoint RCE; the Megalodon campaign poisons 5,561 GitHub repos in six hours; 7-Eleven's ShinyHunters breach hits 185,000; and a.
- Newsletter
May 20 Digest: Exchange Zero-Day, Verizon DBIR, GitHub
A Microsoft Exchange zero-day is being exploited with no patch in sight; Verizon DBIR 2026 marks a landmark shift — vulnerability exploitation now...
- News
7-Eleven Confirms Data Breach Claimed by the ShinyHunters
Convenience store giant 7-Eleven has confirmed a data breach after the ShinyHunters extortion group publicly claimed responsibility for the attack. The...
- News
7-Eleven Data Breach Confirmed After ShinyHunters Ransom
7-Eleven has confirmed a data breach after ShinyHunters claimed to have stolen more than 600,000 Salesforce records containing personal information and...
- News
Grafana Confirms Breach After Hackers Claim They Stole Data
Grafana has confirmed a security breach after the Coinbase Cartel cybercrime group — linked to ShinyHunters, Scattered Spider, and Lapsus$ — claimed to...
- News
Government to Scrutinize Instructure Over Canvas
The House Committee on Homeland Security has demanded a briefing from Instructure, the company behind the Canvas LMS platform, after a ransomware attack...
- News
Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65 TB Canvas Leak
Educational technology company Instructure, parent of Canvas LMS, has reached an undisclosed 'agreement' with the ShinyHunters extortion group after a...
- Newsletter
May 12 Digest: AI-Generated Zero-Day, Shai-Hulud Worm
Google confirms the first AI-generated zero-day in the wild; TeamPCP's Mini Shai-Hulud worm hits TanStack, Mistral AI, and Guardrails AI; Instructure pays...
- News
Canvas Login Portals Hacked in Mass ShinyHunters Extortion
ShinyHunters has struck education technology giant Instructure again, exploiting a fresh vulnerability to deface Canvas login portals across hundreds of...
- News
Medtronic Hack Confirmed After ShinyHunters Threatens Data
Medical device giant Medtronic has confirmed a data breach after the ShinyHunters cybercrime group claimed to have stolen records belonging to 9 million...
- Newsletter
Apr 28 Digest: Medtronic 9M Breach, GitHub RCE, LiteLLM
ShinyHunters hits Medtronic and ADT in the same week, exposing millions of records; a critical one-push RCE lands in GitHub; LiteLLM's pre-auth SQL...
- News
Home Security Giant ADT Data Breach Affects 5.5 Million
The ShinyHunters extortion group stole the personal information of 5.5 million individuals after breaching the systems of home security giant ADT earlier...
- News
ADT Confirms Data Breach After ShinyHunters Leak Threat
Home security giant ADT has confirmed a data breach after the ShinyHunters extortion group threatened to publish stolen data unless a ransom is paid,...
- News
Next.js Creator Vercel Hacked
Vercel confirmed suffering a breach after a hacker claiming to be part of ShinyHunters offered to sell stolen data for $2 million, affecting the company...
- News
In Other News: Satellite Cybersecurity Act, $90K Chrome
This week's cybersecurity roundup covers the proposed Satellite Cybersecurity Act, a $90,000 Chrome heap overflow bug, a 16-year-old hacker arrest,...
- News
Hims & Hers Breach Exposes the Most Sensitive Kinds of Patient PHI
ShinyHunters exploited compromised Okta SSO credentials to breach the Hims & Hers Zendesk customer support platform, exposing treatment category data for...
- News
Blast Radius of TeamPCP Attacks Expands Amid Hacker
As organizations disclose breaches tied to TeamPCP's supply chain attacks, ShinyHunters and Lapsus$ are taking credit and creating a murky attribution...
- News
European Commission Confirms Data Breach After Europa.eu
The European Commission has confirmed a data breach after its Europa.eu web platform was compromised in an attack claimed by the ShinyHunters extortion gang.
- News
ShinyHunters Breach Infinite Campus — K-12 Platform Serving
ShinyHunters claimed a breach of Infinite Campus on March 22, 2026, after gaining access through an employee's Salesforce account. The K-12 student...
- News
Telus Digital Confirms Massive Breach After ShinyHunters
Canadian telecom giant Telus Digital has confirmed a security incident after the ShinyHunters hacking group claimed to have stolen nearly 1 petabyte of...
- News
ShinyHunters Claims Mass Data Theft From 400 Firms via Salesforce Aura
Cybercrime group ShinyHunters claims to have exploited misconfigured Salesforce Experience Cloud instances to steal CRM data from approximately 400...
- News
Fintech Giant Figure Technology Confirms Breach: Nearly 1
Blockchain-based lending platform Figure Technology Solutions confirms a data breach affecting nearly 1 million customers after ShinyHunters exploited an...
- News
ShinyHunters Dumps Harvard and UPenn Data After Ransom
The ShinyHunters cybercriminal syndicate has published stolen data from Harvard University and the University of Pennsylvania after both institutions...
- News
Scattered Lapsus$ ShinyHunters Alliance Hits 100+
The SLSH alliance combining Scattered Spider, Lapsus$, and ShinyHunters has attacked over 100 organizations since the start of 2026, breaching 60 million...
- News
ShinyHunters Dumps 600K+ Canada Goose Customer Records Online
Data extortion group ShinyHunters posts 1.67 GB of alleged Canada Goose customer data including names, emails, addresses, and partial payment card...
- News
ShinyHunters Dumps 5.1 Million Panera Bread Customer
The ShinyHunters hacking group published a 760 MB archive of 5.1 million Panera Bread customer records on the dark web after the company refused to pay a...