ShinyHunters

Active
103 victims named on the leak site
15 in the last 30 days
103 in the last 12 months
Jan 2026 first victim we recorded
Sep 14, 2026 most recent victim posted
5 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

73.8% of ShinyHunters victims whose domain we can identify (76 of 103) had employee credentials leak in the 12 months before ShinyHunters named them as a victim.

We don't know whether any of these credentials were how ShinyHunters gained initial access.

What industries ShinyHunters targets

Sector identified for 74 of 103 victims.

Financial Services15
Healthcare13
Education11
Technology8
Retail5
Telecommunications5
Hospitality3
Manufacturing3

Where the victims are located

Country identified for 100 of 103 victims.

United States81
Switzerland4
Canada3
Germany2
Netherlands2
France2
Ireland1
Spain1

Most recent ShinyHunters victims

VictimSectorCountryPosted
Kimberly-Clark kimberly-clark.comNot identifiedUnited StatesSep 14, 2026
Florida Department of Highway Safety and Motor Vehicles flhsmv.govGovernmentUnited StatesSep 8, 2026
Medela medela.comHealthcareSwitzerlandSep 8, 2026
Elekta elekta.comHealthcareSwedenAug 31, 2026
Jack Henry & Associates jackhenry.comFinancial ServicesUnited StatesAug 31, 2026
McKesson mckesson.comHealthcareUnited StatesAug 31, 2026
Neogen neogen.comHealthcareUnited StatesAug 31, 2026
BOK Financial bokfinancial.comFinancial ServicesUnited StatesAug 24, 2026
CyrusOne cyrusone.comNot identifiedUnited StatesAug 24, 2026
Novocure novocure.comNot identifiedSwitzerlandAug 24, 2026
ReliaQuest reliaquest.comTechnologyUnited StatesAug 24, 2026
Baxter International baxter.comHealthcareUnited StatesAug 19, 2026
Carhartt carhartt.comNot identifiedUnited StatesAug 19, 2026
Cook Medical cookmedical.comHealthcareUnited StatesAug 19, 2026
Sharecare sharecare.comHealthcareUnited StatesAug 19, 2026
Alcon alcon.comHealthcareSwitzerlandAug 3, 2026
Lumenis lumenis.comHealthcareIsraelAug 3, 2026
Questel questel.comNot identifiedFranceAug 3, 2026
Brinks Home brinkshome.comNot identifiedUnited StatesJul 28, 2026
Ernst & Young ey.comNot identifiedNot identifiedJul 28, 2026

Showing the 20 most recent of 103. Browse recent data breaches for more.

ShinyHunters leak sites

Addresses we've seen ShinyHunters publish victims from. Any .onion address needs the Tor Browser.

  • shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion
  • toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion
  • shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion
  • shinyhunte.rs
  • incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion

ShinyHunters questions

Is ShinyHunters still active?

Yes. ShinyHunters posted its most recent victim on September 14, 2026. That's 15 victims in the last 30 days.

How many victims has ShinyHunters claimed?

ShinyHunters has named 103 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did ShinyHunters first appear?

The first victim we recorded for ShinyHunters was posted on January 26, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does ShinyHunters target?

Financial Services accounts for the most victims we can classify, with 15. Healthcare follows at 13. We could identify a sector for 74 of 103 victims, so treat this as the shape of the targeting rather than a full census.

Has ShinyHunters already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.