ShinyHunters

Active
104 victims named on the leak site
4 in the last 30 days
104 in the last 12 months
Jan 2026 first victim we recorded
Sep 24, 2026 most recent victim posted
5 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

74% of ShinyHunters victims whose domain we can identify (77 of 104) had employee credentials leak in the 12 months before ShinyHunters named them as a victim.

We don't know whether any of these credentials were how ShinyHunters gained initial access.

What industries ShinyHunters targets

Sector identified for 75 of 104 victims.

Financial Services15
Healthcare14
Education11
Technology8
Retail5
Telecommunications5
Hospitality3
Manufacturing3

Where the victims are located

Country identified for 101 of 104 victims.

United States81
Switzerland4
Germany3
Canada3
Netherlands2
France2
Ireland1
Spain1

Most recent ShinyHunters victims

VictimSectorCountryPosted
Fresenius Medical Care freseniusmedicalcare.comHealthcareGermanySep 24, 2026
Kimberly-Clark kimberly-clark.comNot identifiedUnited StatesSep 14, 2026
Florida Department of Highway Safety and Motor Vehicles flhsmv.govGovernmentUnited StatesSep 8, 2026
Medela medela.comHealthcareSwitzerlandSep 8, 2026
Elekta elekta.comHealthcareSwedenAug 31, 2026
Jack Henry & Associates jackhenry.comFinancial ServicesUnited StatesAug 31, 2026
McKesson mckesson.comHealthcareUnited StatesAug 31, 2026
Neogen neogen.comHealthcareUnited StatesAug 31, 2026
BOK Financial bokfinancial.comFinancial ServicesUnited StatesAug 24, 2026
CyrusOne cyrusone.comNot identifiedUnited StatesAug 24, 2026
Novocure novocure.comNot identifiedSwitzerlandAug 24, 2026
ReliaQuest reliaquest.comTechnologyUnited StatesAug 24, 2026
Baxter International baxter.comHealthcareUnited StatesAug 19, 2026
Carhartt carhartt.comNot identifiedUnited StatesAug 19, 2026
Cook Medical cookmedical.comHealthcareUnited StatesAug 19, 2026
Sharecare sharecare.comHealthcareUnited StatesAug 19, 2026
Alcon alcon.comHealthcareSwitzerlandAug 3, 2026
Lumenis lumenis.comHealthcareIsraelAug 3, 2026
Questel questel.comNot identifiedFranceAug 3, 2026
Brinks Home brinkshome.comNot identifiedUnited StatesJul 28, 2026

Showing the 20 most recent of 104. Browse recent data breaches for more.

ShinyHunters leak sites

Addresses we've seen ShinyHunters publish victims from. Any .onion address needs the Tor Browser.

  • shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion
  • toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion
  • shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion
  • shinyhunte.rs
  • incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion

ShinyHunters questions

Is ShinyHunters still active?

Yes. ShinyHunters posted its most recent victim on September 24, 2026. That's 4 victims in the last 30 days.

How many victims has ShinyHunters claimed?

ShinyHunters has named 104 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.

When did ShinyHunters first appear?

The first victim we recorded for ShinyHunters was posted on January 26, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does ShinyHunters target?

Financial Services accounts for the most victims we can classify, with 15. Healthcare follows at 14. We could identify a sector for 75 of 104 victims, so treat this as the shape of the targeting rather than a full census.

Has ShinyHunters already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.