ShinyHunters

Profile narrative

ShinyHunters is a threat actor group known for cybercriminal activities targeting organizations to steal and sell large volumes of user data. Operating primarily on dark web marketplaces, the group has engaged in data exfiltration from multiple companies, subsequently offering the stolen databases for sale to other criminal actors. The group's activities have spanned various sectors and geographic regions, affecting e-commerce platforms, online learning services, and technology companies, among others. Their operations rely on breaching corporate systems, extracting sensitive records, and monetizing this data through underground markets rather than providing legitimate products or services.

The scale of ShinyHunters' operations was notably demonstrated in a single campaign reported on May 2, 2020, during which the group compromised eleven companies. In this campaign, approximately 73.2 million user records were exfiltrated and advertised for sale, with databases priced between $1,500 and $3,500 each. Among the victims were a major Indonesian e-commerce platform, a prominent Indian online learning service, and Microsoft's GitHub account, the latter resulting in the exposure of private source code repositories. The breadth of victims across different industries and countries indicates a broad targeting approach rather than specialization in a single sector. Some victim organizations confirmed breaches after being alerted to the data sales, while others did not respond, suggesting varied awareness or response capabilities among affected entities. Analysis of leaked samples at the time indicated that the stolen data appeared legitimate, though complete verification of the full datasets remained pending.

The group's distinguishing attributes lie in their prolific activity on dark web marketplaces and their ability to simultaneously breach and monetize data from multiple organizations. By focusing on the theft of large user databases, ShinyHunters has positioned itself within the cybercriminal ecosystem as a broker of stolen credentials and personal information. The group's methodology of directly selling databases rather than demanding ransoms from victims represents a particular approach to data monetization. No information is available regarding any formal organizational structure, ownership, or affiliation with other threat groups beyond their alias as ShinyHunters. Likewise, details about the geographic origin or leadership of the group are not confirmed in the available material.

Incidents

1 incident linked to this organisation.