#shinyhunters
2 cases
ShinyHunters Salesforce Data Extortion and SaaS Supply-Chain Campaign (2025–2026)Data BreachSupply Chain Attack
Between mid-2025 and August 2026, a cybercriminal collective operating primarily under the ShinyHunters brand—alongside associated activity clusters tracked as UNC6040, UNC6240, UNC6395, UNC6661, and...
Data BreachSupply Chain Attack
Snowflake Data Theft Campaign (UNC5537): Mass Credential Stuffing Across 165+ OrganizationsData BreachExtortion & Blackmail
A financially motivated threat actor (UNC5537) compromised Snowflake customer instances across 165+ organizations by credential stuffing against accounts lacking MFA, exfiltrating terabytes of sensitive data, and conducting mass extortion — the largest cloud data warehouse compromise to date.
Data BreachExtortion & Blackmail