Quick links
Press Enter to search, Esc to close
Threat group profile
The FBI describes ShinyHunters as a cyber criminal group that specializes in large-scale data breaches and extortion, and Europol describes a coalition of it with Scattered Spider and LAPSUS$ called Scattered LAPSUS$ Hunters (SLSH).
In short
The FBI describes ShinyHunters as a cyber criminal group that specializes in large-scale data breaches and extortion, and Europol describes a coalition of it with Scattered Spider and LAPSUS$ called Scattered LAPSUS$ Hunters (SLSH). The US Department of Justice prosecuted a member in 2023 and 2024, and the Dutch National Police arrested a suspect in September 2026.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| ShinyHunters | MITRE ATT&CK G1057 (group name); FBI Public Service Announcement of 15 May 2026; US Department of Justice press releases[1, 2, 4] |
| ShinyCorp | MITRE ATT&CK G1057 (persona the group operates under)[1] |
| UNC6240 | MITRE ATT&CK G1057 (Associated Groups)[1] |
| Bling Libra | MITRE ATT&CK G1057 (Associated Groups)[1] |
| The Community (The Com) | MITRE ATT&CK G1057 (broader collective the group has been associated with)[1] |
| Scattered Lapsus Hunters, Scattered Lapsus Shiny Hunters, SLSH | MITRE ATT&CK G1057 (names used for operations with members of other groups); Europol IOCTA 2026 uses Scattered LAPSUS$ Hunters (SLSH)[1, 7] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
US Department of Justice (Western District of Washington) 26 January 2023
Said a grand jury indicted a French national and two co-conspirators on 23 June 2021, and that the defendant took part in a hacking group that called itself ShinyHunters. The indictment alleges it advertised stolen data for sale and sometimes threatened to leak it unless a ransom was paid.[4]
US Department of Justice (Western District of Washington) 27 September 2023
Said that between April 2020 and July 2021 a user going by ShinyHunters posted hacked data from more than 60 companies for sale on dark web forums, and that the conspirators stole hundreds of millions of customer records, with losses estimated to exceed $6 million.[5]
US Department of Justice (Western District of Washington) 9 January 2024
Announced a sentence of three years in prison and more than $5 million in restitution for a member of the group.[6]
FBI 15 May 2026
Warned that ShinyHunters, a cyber criminal group specializing in large-scale data breaches and extortion, claimed a cyber-attack that disrupted an online learning management system used by schools across the country.[2]
FBI 12 September 2025
Said some victims of the cluster it tracks as UNC6040 later received extortion emails allegedly from ShinyHunters, demanding cryptocurrency to avoid publication of stolen data.[3]
MITRE ATT&CK 31 July 2026 (page last modified)
Describes ShinyHunters as a cyber criminal collective active since at least 2019 under the ShinyCorp persona, associated with The Community, whose members have also included Scattered Spider and LAPSUS$.[1]
Europol 2026 (IOCTA 2026)
Describes the alleged Scattered LAPSUS$ Hunters alliance between Scattered Spider, ShinyHunters and LAPSUS$ that emerged in August 2025, and says ShinyHunters ran a May 2025 campaign that took over a billion Salesforce customer records.[7]
Dutch National Police 29 September 2026
Said it arrested a 24-year-old man from Amsterdam on 15 September 2026 on suspicion of a role in ShinyHunters and of taking part in a criminal organization, and described the group as a criminal hacker and extortion group.[8]
FBI 29 September 2026
Announced the arrest, executed by the Dutch National Police, of one of the alleged leaders of ShinyHunters, and said the group and its co-conspirators allegedly breached more than 140 organizations and took at least $70 million in extortion payments since last year.[9]
Sources differ on how far back the group goes. MITRE says active since at least 2019, while the US indictment describes data sales from early 2020 and the Department of Justice counts postings from April 2020 to July 2021. Sources also differ on scope: the 2023 and 2024 US court records cover one member and about 60 companies up to mid-2021, while the FBI statement of 29 September 2026 refers to more than 140 organizations since 2025, and says these are allegations. The FBI tracks the Salesforce intrusion clusters under the separate designations UNC6040 and UNC6395, and says only that some UNC6040 victims received ShinyHunters extortion emails; it does not say the clusters are the same group. No source opened gives a country of origin for the group.
Each entry is attributed to the group by the sources cited.
MITRE says ShinyHunters has been active since at least 2019 under the ShinyCorp persona.[1]
The US Department of Justice says that from April 2020 a user going by ShinyHunters posted hacked company data for sale on dark web forums.[5]
The DOJ counts postings from more than 60 companies between April 2020 and July 2021.[5]
The DOJ announces that the defendant, arrested in Morocco in 2022, appears in Seattle on a nine-count indictment.[4]
The defendant pleads guilty to conspiracy to commit wire fraud and aggravated identity theft.[5]
The defendant is sentenced to three years in prison and more than $5 million in restitution.[6]
Europol says ShinyHunters launched a campaign that siphoned over a billion Salesforce customer records by tricking victims into connecting a malicious app.[7]
Europol says the alleged alliance of Scattered Spider, ShinyHunters and LAPSUS$ appeared.[7]
The FBI publishes indicators for UNC6040 and UNC6395 and says some UNC6040 victims later got ShinyHunters extortion emails.[3]
The FBI warns of ShinyHunters activity after an attack on a learning management system.[2]
The Dutch National Police arrest a 24-year-old man on suspicion of a role within ShinyHunters.[8]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 23 June 2021 (announced 26 January 2023) | US Department of Justice, Western District of Washington | IndictmentNine counts including conspiracy to commit computer fraud and abuse, conspiracy to commit wire fraud, wire fraud and aggravated identity theft; the defendant was extradited from Morocco in January 2023.[4] |
| 27 September 2023 | US Department of Justice, Western District of Washington | Guilty pleaConspiracy to commit wire fraud and aggravated identity theft; the maximum for the fraud conspiracy is 27 years.[5] |
| 9 January 2024 | US Department of Justice, Western District of Washington | SentenceThree years in prison and more than $5 million in restitution.[6] |
| 12 September 2025 | FBI, coordinated with DHS/CISA | FLASH alertIndicators of compromise and technical details for two Salesforce data theft clusters, one linked to ShinyHunters extortion.[3] |
| 15 May 2026 | FBI Internet Crime Complaint Center | Public Service AnnouncementWarns of ShinyHunters pressure tactics and advises not to pay or respond to demands.[2] |
| 15 September 2026 | Dutch National Police | Arrest24-year-old man from Amsterdam arrested on suspicion of a role in ShinyHunters and of taking part in a criminal organization.[8] |
| 29 September 2026 | FBI | Public statementAnnounces the arrest and calls on remaining members to come forward.[9] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Acquire Infrastructure: Domains T1583.001
MITRE says the group set up clearnet and Tor data leak sites and registered domains that imitate cloud and single sign-on pages.[1]
Obtain Capabilities: Artificial Intelligence T1588.007
MITRE says the group used an AI service to build conversational scripts for voice phishing.[1]
Valid Accounts: Cloud Accounts T1078.004
MITRE says the group used valid cloud accounts to get in or raise privileges.[1]
Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1195.001
MITRE says the group compromised CI/CD pipelines through high-privilege engineering accounts.[1]
Modified Salesforce Data Loader Malicious connected app
The FBI says the actors guided victims to approve a malicious connected app that is often a modified version of the Data Loader, which allows access and bulk exfiltration.[3]
MeshCentral Remote management tool
MITRE says the group obtained it and disguised its agent files as cloud service names.[1]
ConnectWise remote access software Legitimate remote access tool
MITRE says the group used it to gain initial access and to run commands.[1]
WinSCP and S3 Browser File transfer and storage tools
MITRE says the group used them to collect information on and access cloud storage buckets.[1]
AWS command line interface Cloud management tool
MITRE says the group used it for storage API calls including listing, creating and deleting buckets.[1]
Tor Anonymizing network
MITRE lists Tor (S0183) as software used to host the group's data leak site.[1, 10]
Tor data leak site Extortion site
The FBI says the group has sometimes posted exfiltrated data to various versions of its data leak site on the Tor network.[2]
The FBI says not to send payment or respond to demands, and to verify contacts claiming to be from your school or provider through known channels.
Counters T1657
The FBI asks victims to report to the Internet Crime Complaint Center or a local field office and to keep usernames, email addresses, monikers and platforms used.
Counters T1657
The FBI advises contacting account providers, changing passwords and placing alerts on accounts for suspicious sign-in attempts.
Counters T1078.004
Watch for company data, logins and leak-site posts that name your organization, since the FBI says the group posts stolen data on Tor leak sites.
Find look-alike sign-in pages and domains, since the DOJ and MITRE describe fake login pages and imitation single sign-on domains.
See which cloud platforms, connected services and exposed systems of yours are reachable from the internet.
Help leaders and staff find exposed personal details, since the FBI describes harassment of victims and their families.
Follow what government sources report about this group and check your help desk and connected-app controls against it.
The FBI describes ShinyHunters as a cyber criminal group specializing in large-scale data breaches and extortion. MITRE says it has been active since at least 2019 and that it is associated with The Community, whose members have also included Scattered Spider and LAPSUS$.
Europol describes the alleged Scattered LAPSUS$ Hunters (SLSH) alliance of Scattered Spider, ShinyHunters and LAPSUS$ that emerged in August 2025. MITRE lists the names Scattered Lapsus Hunters, Scattered Lapsus Shiny Hunters and SLSH for operations ShinyHunters members reportedly conducted with other groups.
The FBI describes phone calls to call centers posing as IT support, followed by approval of a malicious connected app in a customer-data platform. The US Department of Justice describes fake sign-in pages reached by phishing emails. MITRE adds stolen OAuth tokens and access to code repositories.
A French national who took part in the group was sentenced in the US in January 2024 to three years in prison. The Dutch National Police arrested a 24-year-old man from Amsterdam on 15 September 2026 on suspicion of a role in the group, and the FBI called him one of its alleged leaders.
The sources opened describe data theft and extortion: stolen data is held for payment and sometimes posted on Tor leak sites. None of the sources opened describes file-encrypting ransomware as the group's method.
The FBI says not to send payment or respond to demands, to verify contacts through known channels, to change passwords, and to report the incident to the Internet Crime Complaint Center at ic3.gov.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.