ShinyHunters is a black-hat criminal hacker and extortion group that has been active since 2019 and is said to have been involved in a significant number of data breaches.
ShinyHunters has utilized cloud misconfigurations, OAuth token theft via integration companies, supply chain attacks, zero-day exploits, voice phishing and other forms of advanced social engineering to gain access to the systems of its targets. After gaining access to a target, the group has been known to exfiltrate data and demand ransom payments. If targets do not pay the ransom, the stolen information is often leaked or sold on the dark web. ShinyHunters is believed to be affiliated with The Com, a large international network of cybercriminals.
Identity and membership The name of the group is believed to be derived from Shiny Pokémon, an aspect of the Pokémon video game franchise whereby Pokémon have a rare chance of being encountered in an alternate, "shiny" color scheme; actively trying to collect such Pokémon through in-game strategies are often referred to as "shiny hunting".
There has been at least one instance of conflict over the legitimacy of the ShinyHunters name. The April 2026 breach of Vercel was carried out by an entity that claimed to be ShinyHunters, but the leadership associated with the real ShinyHunters denied that ShinyHunters was involved.
ShinyHunters' membership is believed to partially overlap with other groups linked to international cybercrime network The Com, including Scattered Spider and Lapsus$. Cybercrime group Scattered Lapsus$ Hunters claims to include members of all three groups. One of three administrators of the SLSH Telegram channel, operating under the alias "Rey," was publicly identified in November 2025 as a 15-year-old from Jordan. Google-owned cybersecurity firm Mandiant described ShinyHunters as "multiple threat clusters" operating under a single brand in January 2026, and a February 2026 analysis by Kim Zetter describes ShinyHunters and its peer groups as "[l]oose-knit cells" of The Com.
Legal actions In May 2022, Sébastien Raoult, a French programmer suspected of belonging to the group, was arrested in Morocco and extradited to the United States. He faced 20 to 116 years in prison. In January 2024, Raoult was sentenced to three years in prison and ordered to return $5 million. Twelve months of the sentence are for conspiracy to commit wire fraud and the remainder for aggravated identity theft. He will face 36 months of supervised release afterwards. Raoult had worked for the group for more than two years according to the U.S. Attorney's Office for the Western District of Washington, but was not a major player within the group.
In May-June 2025, U.S. prosecutors in the District of Massachusetts charged Matthew D. Lane, a 19-year-old Massachusetts student, with hacking and extorting an education-technology provider widely reported to be PowerSchool. Prosecutors said that Lane used stolen contractor credentials to access the company's network in 2024, exfiltrate data on tens of millions of students and teachers, and demand a $2.85 million bitcoin ransom. Lane agreed to plead guilty on May 20, 2025, and entered a guilty plea on June 6, 2025. In November 13, 2025, he was sentenced to four years in prison, three years of supervised release, a fine of $25,000, restitution of $14,075,540.58 and forfeiture.
On June 25, 2025, French authorities announced that four members of the ShinyHunters cybercriminal group were arrested in multiple French regions for cybercrime activities. The coordinated global law enforcement effort targeted the "ShinyHunters", "Hollow", "Noct", and "Depressed" aliases. However, the leadership remained active throughout and after the arrests.
Notable data breaches
2020 Mathway: In January 2020, ShinyHunters breached Mathway, stealing roughly 25 million users' data. Mathway is an app for students that helps solve algebraic equations. Tokopedia: On May 2, 2020, Tokopedia was breached by ShinyHunters, which claimed to have data for 91 million user accounts, revealing users' gender, location, username, full name, email address, phone number, and hashed passwords. Wishbone: Also in May 2020, ShinyHunters leaked the full user database of the social media app Wishbone, which is said to contain personal information such as usernames, emails, phone numbers, city/state/country of residence, and hashed passwords. Microsoft: In May 2020, ShinyHunters also claimed to have stolen over 500 GB of Microsoft source code from the company's private GitHub account. The group published around 1GB of data from the hacked GitHub account on a hacking forum. Some cybersecurity experts doubted the claims until analyzing the code; upon analysis, ShinyHunters' claims were no longer in question. Microsoft told Wired in a statement that they are aware of the breach. Microsoft later secured its GitHub account, which was confirmed by ShinyHunters as they reported being unable to access any repositories. Wattpad: In July 2020, ShinyHunters gained access to a Wattpad database containing 270 million user records. Information leaked included usernames, real names, hashed passwords, email addresses, geographic location, gender, and date of birth. Pluto TV: In November 2020, it was reported that ShinyHunters gained access to the personal data of 3.2 million Pluto TV users. The hacked data included users' display names, email addresses, IP addresses, hashed passwords and dates of birth. Animal Jam: It was also reported in November 2020 that ShinyHunters was behind the hack of Animal Jam, leading to the exposure of 46 million accounts. Mashable: In November 2020, ShinyHunters leaked 5.22 GB worth of the Mashable database on a prominent hacker forum.
2021 Pixlr: In January 2021, ShinyHunters leaked 1.9 million user records from Pixlr. Nitro PDF: In January 2021, a hacker claiming to be a part of ShinyHunters leaked the full database of Nitro PDF – which contains 77 million user records – on a hacker forum for free. Bonobos: In January 2021, it was reported that ShinyHunters leaked the full backup cloud database of Bonobos, a clothing company, to a hacker forum. The database is said to contain the address, phone numbers, and order details for 7 million customers; general account information for another 1.8 million registered customers; and 3.5 million partial credit card records and hashed passwords. AT&T Wireless: In 2021, ShinyHunters began selling information on 70 million AT&T wireless subscribers, which contained users' phone numbers, personal information and social security numbers. AT&T acknowledged the data breach in 2024. Aditya Birla Fashion and Retail: In December 2021, Indian retailer Aditya Birla Fashion and Retail was breached and ransomed. The ransom demand was allegedly rejected and data containing 5.4 million unique email addresses were subsequently dumped publicly on a popular hacking forum the next month. The data contained extensive personal customer information including names, phone numbers, physical addresses, birth dates, order histories and passwords stored as MD5 hashes.
2023 Pizza Hut Australia: In September 2023, ShinyHunters claimed to have compromised more than 1 million customers' data and 30 million order records of Pizza Hut Australia. Pizza Hut Australia later acknowledged and confirmed the data breach.
2024
AT&T Wireless: In April 2024, ShinyHunters again hacked AT&T Wireless and stole data on over 110 million customers. In May, AT&T paid a $370,000 ransom to one of the group's members to delete the data. Banco Santander: On May 30, 2024, the Spanish multinational bank Santander was breached by ShinyHunters, resulting in all Santander staff and 30 million customers in Spain, Chile and Uruguay compromised. Ticketmaster: ShinyHunters claimed responsibility for breaching Ticketmaster via their campaign targeting customers of the cloud storage firm Snowflake. PowerSchool: In December 2024, education-software vendor PowerSchool was breached; the attacker demanded $2.85 million and the company paid a ransom to prevent release of stolen student/teacher data. In early May 2025, new extortion emails began hitting individual school districts that were customers of PowerSchool, with outlets reporting attempts to leverage the stolen data from an earlier, unrelated PowerSchool breach identified by CrowdStrike. One message shared with DataBreaches.net demanded payment from North Carolina authorities, though the publication cautioned it could not authenticate the sender's identity. Bleeping Computer likewise reported that someone claiming to be ShinyHunters was extorting districts/customers of PowerSchool, while a person identifying as the group's leader told the outlet the culprit was an affiliate impersonating them.
2025
Legal Aid Agency (U.K. Ministry of Justice): The Ministry of Justice disclosed on May 22, 2025 (updated September 4, 2025), that the Legal Aid Agency (LAA) suffered a cyber incident affecting applicants who used its digital service from 2007 until systems were taken offline on May 16, 2025; the MoJ has not named a culprit and says investigations are ongoing. In August 2025, multiple outlets reported that a group using the ShinyHunters name posted on Telegram (Scattered Lapsus$ Hunters) claiming responsibility and threatening to leak LAA data unless a member was freed; The Times and The Law Society Gazette covered the claim while noting authorities had not verified the posts and that the deadline passed without a leak. LVMH: In mid-2025, luxury conglomerate LVMH confirmed that several of its brands – including Louis Vuitton, Dior, and Tiffany & Co. – experienced unauthorized access to a customer information database managed by a third-party platform. While each subsidiary disclosed limited details (Tiffany & Co.'s Korean unit noted a "vendor platform" was breached), investigators later tied these incidents to the ShinyHunters Salesforce data-theft campaign. The threat actors privately extorted the firms via email (using the ShinyHunters name) and were ultimately identified as part of the UNC6040/UNC6240 clusters described by Google. Google: On June 4, 2025, Google Threat Intelligence Group (GTIG) reported on UNC6040, a cluster of voice phishing campaigns targeting organizations' Salesforce instances. The attackers used modified versions of Data Loader to export Salesforce data and subsequently extort the victims. GTIG attributed the activity to ShinyHunters. On August 5, 2025, Google confirmed that a corporate Salesforce instance of Google's containing contact information and notes for small and medium-sized businesses had been compromised by UNC6040/ShinyHunters activity. Qantas: In July 2025, Australian airline Qantas suffered a cyberattack that exposed data of approximately 5.7 million customers. Initially attributed to Scattered Spider by multiple professional security researchers and journalists, it was later confirmed to be the work of ShinyHunters. Jaguar Land Rover: On September 2, 2025, Jaguar Land Rover (JLR) disclosed a cyber incident and proactively shut down systems, causing severe disruption to production and retail operations. In the days that followed, outlets reported that a ShinyHunters/Scattered Spider–aligned collective claimed responsibility; JLR said there was no evidence of customer data theft at that time and notified the UK ICO.