ShinyHunters

Active
88 victims named on the leak site
6 in the last 30 days
88 in the last 12 months
Jan 2026 first victim we recorded
Aug 3, 2026 most recent victim posted
5 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

73.9% of ShinyHunters victims whose domain we can identify (65 of 88) had employee credentials leak in the 12 months before ShinyHunters named them as a victim.

We don't know whether any of these credentials were how ShinyHunters gained initial access.

What industries ShinyHunters targets

Sector identified for 63 of 88 victims.

Financial Services13
Education11
Technology7
Healthcare6
Retail5
Telecommunications5
Hospitality3
Manufacturing3

Where the victims are located

Country identified for 85 of 88 victims.

United States69
Canada3
Germany2
Netherlands2
Switzerland2
France2
Ireland1
Spain1

Most recent ShinyHunters victims

VictimSectorCountryPosted
Alcon alcon.comHealthcareSwitzerlandAug 3, 2026
Lumenis lumenis.comHealthcareIsraelAug 3, 2026
Questel questel.comNot identifiedFranceAug 3, 2026
Brinks Home brinkshome.comNot identifiedUnited StatesJul 28, 2026
Ernst & Young ey.comNot identifiedNot identifiedJul 28, 2026
RingCentral ringcentral.comTechnologyUnited StatesJul 28, 2026
Exact Sciences exactsciences.comNot identifiedUnited StatesJul 16, 2026
Fluke fluke.comHealthcareUnited StatesJul 7, 2026
Ingram Content Group ingramcontent.comMediaUnited StatesJul 7, 2026
Inter-Con Security Systems icsecurity.comGovernmentUnited StatesJun 19, 2026
National Association of Insurance Commissioners naic.orgFinancial ServicesUnited StatesJun 19, 2026
One Medical onemedical.comHealthcareUnited StatesJun 19, 2026
Glendale Community College glendale.eduEducationUnited StatesJun 16, 2026
Illinois Central College icc.eduEducationUnited StatesJun 16, 2026
Moody Bible Institute moody.eduEducationUnited StatesJun 16, 2026
Zayo.com & Allstream.com allstream.comTechnologyCanadaJun 15, 2026
American Tower americantower.comTelecommunicationsUnited StatesJun 15, 2026
The Council of Europe coe.intNot identifiedFranceJun 15, 2026
JCPenney jcpenney.comRetailUnited StatesJun 15, 2026
Madison Square Garden Sports Corp. msgsports.comNot identifiedUnited StatesJun 15, 2026

Showing the 20 most recent of 88. Browse recent data breaches for more.

ShinyHunters leak sites

Addresses we've seen ShinyHunters publish victims from. Any .onion address needs the Tor Browser.

  • shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion
  • toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion
  • shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion
  • shinyhunte.rs
  • incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion

ShinyHunters questions

Is ShinyHunters still active?

Yes. ShinyHunters posted its most recent victim on August 3, 2026. That's 6 victims in the last 30 days.

How many victims has ShinyHunters claimed?

ShinyHunters has named 88 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did ShinyHunters first appear?

The first victim we recorded for ShinyHunters was posted on January 26, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does ShinyHunters target?

Financial Services accounts for the most victims we can classify, with 13. Education follows at 11. We could identify a sector for 63 of 88 victims, so treat this as the shape of the targeting rather than a full census.

Has ShinyHunters already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.