ShinyHunters is a black-hat criminal hacker and extortion group that is believed to have formed in 2019, and is said to have been involved in a significant amount of data breaches. The group has built a reputation of "pay or leak"; they often extort the company they've hacked, and if the company does not pay the ransom the stolen information is very often leaked or sold on the dark web.
ShinyHunters forged a cybercrime collective with Scattered Spider and Lapsus$ in 2025, which has created at least 16 Telegram channels since August 8, 2025.
The name of the group is believed to be derived from Shiny Pokémon, an aspect of the Pokémon video game franchise where Pokémon have a rare chance of being encountered in an alternate, "shiny" color scheme; players who actively try to collect such Pokémon through in-game strategies are often referred to as "shiny hunters".
In 2024, The ShinyHunters cybercriminal group claimed to have hacked Snowflake-related customers including Ticketmaster, Santander Bank, Neiman Marcus, and many others. The group was also responsible for publishing data stolen from Twilio and Truist Bank.
In June 4, 2025, ShinyHunters was tied to a widespread data-theft campaign targeting Salesforce cloud customers, which Google's Threat Intelligence team tracked as UNC6040. The cybercriminal group working in conjunction with Scattered Spider (now believed to be the same group) and Lapsus$ (also now believed to be the same group or a part of) impersonated IT support staff and used voice phishing (vishing) calls to trick employees into installing a malicious version of Salesforce's Data Loader tool, allowing them to access and extract sensitive customer data by abusing OAuth to bypass traditional authentication methods. Following the successful intrusions, Google's Threat Intelligence team notes the victims of these intrusions receive an extortion or ransom email from the ShinyHunters cybercriminal group, which is also tracked as UNC6240.
This sophisticated social engineering approach led to confirmed data breaches at major companies including Google, Cisco, Adidas, Qantas, Allianz Life, Farmers Insurance Group, Workday, Pandora, Chanel, TransUnion, LVMH subsidiaries, including but not limited to Dior, Louis Vuitton, and Tiffany & Co. It is believed that a lot more victims have been impacted from this campaign, public disclosures are still impending.
Shortly after, in August 28, 2025, another campaign tracked by Google Threat Intelligence (formerly Mandiant) as UNC6395 used OAuth/refresh tokens stolen from Salesloft's Drift integration to access numerous Salesforce customer orgs between August 8âÂÂ18, 2025, systematically exporting CRM data and hunting for credentials (e.g., AWS access keys, passwords, Snowflake tokens). Google told reporters it was aware of over 700 potentially impacted organizations. Public disclosures tied to this campaign include Cloudflare, Workiva, Zscaler, Tenable, CyberArk, Elastic, BeyondTrust, Proofpoint, JFrog, Rubrik, Cato Networks, and Palo Alto Networks, each confirming unauthorized access to data in their Salesforce environments following the Salesloft/Drift compromise. The ShinyHunters cybercriminal group claimed responsibility to the press.
On September 17, 2025, BleepingComputer was able to confirm ShinyHunters was behind the UNC6395 campaign, the biggest SaaS compromise in history. ShinyHunters told BleepingComputer that the threat actors used the TruffleHog security tool to scan the source code for secrets, which resulted in the finding of OAuth tokens for the Salesloft Drift and the Drift Email platforms. Using these stolen Drift OAuth tokens, ShinyHunters told BleepingComputer that the threat actors stole approximately 1.5 billion data records for 760 companies from the "Account", "Contact", "Case", "Opportunity", and "User" Salesforce object tables.
Three months later, in November 20, 2025, once again, another campaign tracked by Google Threat Intelligence Group (formerly Mandiant) as UNC6395-adjacent actors known as ShinyHunters used OAuth/refresh tokens stolen from Gainsight Salesforce integration to access numerous customer instances.
Salesforce publicly reported detecting unusual activity related to applications published by Gainsight that were connected to its platform, leading Salesforce to revoke OAuth access and refresh tokens and temporarily remove related applications from its AppExchange while the investigation was ongoing.
The security incident bore extreme similarity to an earlier ShinyHunters-linked Salesloft Drift breach in August 2025, in which attackers stole OAuth tokens from the Salesloft integration known as Drift, enabling unauthorized access and data theft exfiltration of 760 customer Salesforce instances.
According to external reporting and industry analysis in a statement, Austin Larsen, the principal threat analyst of Google Threat Intelligence Group (formerly Mandiant), said that the company "is aware of more than 200 potentially affected Salesforce instances." Which lined up with what ShinyHunters told several media outlets specifically 285 Salesforce instances. The hacking group claimed responsibility for hacks affecting Atlassian, Docusign, F5, GitLab, Linkedin, Malwarebytes, SonicWall, Thomson Reuters, Verizon, and more.
In November 2025, the ShinyHunters cybercriminal group was linked to a third-party analytics breach at Mixpanel. It affected multiple high-profile companies including Pornhub and OpenAI.
Threat actors exploited a smishing-based compromise of Mixpanel systems, resulting in the export of analytics-related datasets belonging to several customers. ShinyHunters subsequently leveraged this access to extort organizations, claiming to possess analytics records tied to platforms such as Pornhub's Premium service and, indirectly, data associated with OpenAI's API user interactions.
Both OpenAI and Pornhub confirmed that this breach was not a result of their own systems compromised but rather the third-party analytics breach at Mixpanel. Since then OpenAI does not use the analytics provider anymore.
In January 2026, ShinyHunters was linked by multiple media and threat-intelligence firms to a series of social-engineering campaigns targeted enterprise single sign-on (SSO) environments, including Okta. The attacks relied on voice-phishing ("vishing") and credential-harvesting infrastructure rather than exploitation of vulnerabilities in Okta's software, according to Okta and multiple security researchers.
According to a report by BleepingComputer, the ShinyHunters group claimed responsibility for a wave of voice-phishing ("vishing") campaigns that tricked employees into divulging their SSO credentials and multi-factor authentication codes. These credentials were subsequently used to access enterprise SSO dashboards and harvest data from connected software-as-a-service (SaaS) platforms for extortion purposes.
Okta itself publicly warned of active attacks in which threat actors used custom phishing kits and voice-based social engineering to steal SSO credentials, including Okta logins, and abuse those credentials to access cloud applications and exfiltrate data. Okta noted that these attacks did not exploit inherent vulnerabilities in its products, but instead leveraged sophisticated phishing techniques against individual users.
Threat-intelligence analysis published by Google Cloud's Threat Intelligence Group (formerly Mandiant) described how activity consistent with prior ShinyHunters-branded operations involved targeted voice-phishing and credential harvesting sites aimed at capturing SSO logins and MFA tokens. Once obtained, attackers could use the compromised SSO access to move laterally into applications such as Salesforce, Microsoft 365, and other enterprise services and then exfiltrate sensitive data. The analysis noted that some of the campaigns overlapped with ShinyHunters-branded activity tracked under multiple threat clusters.
This ongoing, highly active data theft campaign, as described by Charles Carmakal, CTO of Mandiant at Google Cloud, employs a very sophisticated social engineering approach that has led to data breaches at major companies including but not limited to University of Pennsylvania, Princeton University, Harvard University, Grubhub, Crunchbase, Betterment, Panera Bread, Match Group, Tinder, Hinge, OkCupid, Bumble Inc, Odido, and Wynn Resorts. It is believed that a lot more victims have been impacted from this campaign, public disclosures are still impending.
According to a report by Silent Push, previously founded by FireEye, former owners of Mandiant, the ShinyHunters group and their broader collective "Scattered LAPSUS$ Hunters" ("SLH" / "SLSH") are actively targeting over 100 high-profile organizations in this campaign.
The following are other hacks that have been credited to or allegedly done by ShinyHunters. The estimated impacts of user records affected are also given, if possible.
totalling 1,798,509,000 not accounting for duplicate records between the above mentioned data breaches.
ShinyHunters group is under investigation by the FBI, the Indonesian police, and the Indian police for the Tokopedia breach. Tokopedia's CEO and founder also confirmed this claim via a statement on Twitter.
Minted company reported the group's hack to US federal law enforcement authorities; the investigation is underway.
Administrative documents from California reveal how ShinyHunters' hack has led to Mammoth Media, the creator of the app Wishbone, getting hit with a class-action lawsuit.
Animal Jam stated that they are preparing to report ShinyHunters to the FBI Cyber Task Force and notify all affected emails. They have also created a 'Data Breach Alert' on their site to answer questions related to the breach.
BigBasket filed a First Information Report (FIR) on November 6, 2020, to the Bengaluru Police to investigate the incident.
Dave also initiated an investigation against the group for the company's security breach. The investigation is ongoing and the company is coordinating with local law enforcement and the FBI.
Wattpad stated that they reported the incident to law enforcement and engaged third-party security experts to assist them in an investigation.
Following the ransomware attack on Jaguar and Land Rover, which M&S hackers claimed responsibility for as first reported by the Telegraph, also linked to the groups Scattered Spider and ShinyHunters, the National Cyber Security Centre, part of GCHQ, is understood to be monitoring the situation.
In May 2022, Sébastien Raoult, a French programmer suspected of belonging to the group, was arrested in Morocco and extradited to the United States. He faced 20 to 116 years in prison.
In January 2024 Raoult was sentenced to three years in prison and ordered to return five million dollars. Twelve months of the sentence are for conspiracy to commit wire fraud and the remainder for aggravated identity theft. He will face 36 months of supervised release afterwards. Raoult had worked for the group for more than two years according to the US Attorney's Office for the Western District of Washington, but was not a major player within the group.
In MayâÂÂJune 2025, U.S. prosecutors in the District of Massachusetts charged Matthew D. Lane, a 19-year-old Massachusetts student, with hacking and extorting an education-technology provider widely reported to be PowerSchool; prosecutors said Lane used stolen contractor credentials to access the company's network in 2024, exfiltrate data on tens of millions of students and teachers, and demand a $2.85 million bitcoin ransom. Lane agreed to plead guilty on May 20, 2025, and entered a guilty plea on June 6, 2025.
On June 25, 2025, French authorities announced that four members of the ShinyHunters cyber criminal group were arrested in multiple French regions for cyber crime activities. The coordinated global law enforcement effort targeting the 'ShinyHunters', 'Hollow', 'Noct', and 'Depressed' aliases.
It is believed that the French have arrested an affiliate of the ShinyHunters cyber criminal group and not the ring leader, as they are still active.