#shinyhunters

ShinyHunters extorted Jeppesen ForeFlight, the aviation-navigation unit Boeing sold to Thoma Bravo for $10.55B. Boeing acknowledged the threat-actor claims, the company reported no operational impact, and a suspected member was reportedly detained in Jordan and cooperating with the FBI.

GTIG tracked UNC6240 (linked to ShinyHunters) mass-exploiting PeopleSoft's CVE-2026-35273 (CVSS 9.8 unauth RCE). Defenders who blocked /PSEMHUB at a WAF instead of patching were bypassed: the actor requested /%50SEMHUB/, one URL-encoded character, then dropped web shells and the SIDEEYE backdoor.

Dutch police arrested a 24-year-old Amsterdam man on Sept 15, 2026 in the ShinyHunters investigation; a Rotterdam court remanded him 90 days, and the FBI called him an 'alleged leader.' A separate inquiry into two planned murders abroad is, police say, not part of the ShinyHunters case.

ShinyHunters claims it breached the FBI, defaced FBIjobs.gov, and stole ~2TB on almost all agents via a PeopleSoft zero-day. The defacement is observed and 404 Media matched a data sample to public records — but the FBI says the breach point is undetermined and most is unverified.

ShinyHunters defaced the Clop ransomware gang's Tor leak site with its Umbreon logo and claims it stole the source code, /var/log, and Clop's onion private keys — retaliation over the 2025 Oracle EBS exploit dispute. Only the defacement is independently confirmed; the theft claims are not.

ShinyHunters claimed Florida's DAVID law-enforcement database on 7 September with Jeffrey Epstein's record as proof. The state says one Plant City police credential stored on a personal device was the way in; the attackers say a password-reset flaw across multiple accounts. Both may be true.

ShinyHunters says it vished McKesson employees, took over Okta sessions, and pulled a terabyte from Salesforce and Snowflake between 20 and 25 August 2026. McKesson has confirmed exfiltration of patient data and nothing about how.

Between mid-2025 and August 2026, a cybercriminal collective operating primarily under the ShinyHunters brand—alongside associated activity clusters tracked as UNC6040, UNC6240, UNC6395, UNC6661, and...

A financially motivated threat actor (UNC5537) compromised Snowflake customer instances across 165+ organizations by credential stuffing against accounts lacking MFA, exfiltrating terabytes of sensitive data, and conducting mass extortion — the largest cloud data warehouse compromise to date.