Ggumim

Profile narrative

Ggumim is a South Korea-based organisation whose primary identification in the cybersecurity record is its association with the "Shiny Hunters" hacking collective, an alias under which it became publicly known following a significant data breach and leak event in early May 2020. On 2 May 2020, the group, operating under the Shiny Hunters identity, released and offered for sale a large collection of stolen databases on dark web marketplaces, advertising approximately 73.2 million user records drawn from 11 separate organisations. The affected entities spanned multiple countries and sectors, including a major Indonesian online retailer, a large Indian e-learning platform, and a multinational technology company whose private source code repositories were among the materials exposed. This breadth of targets across e-commerce, education, and technology illustrates the group's opportunistic approach, focusing on organisations holding large volumes of consumer data rather than a single industry vertical.

The scope of the leak was substantial, with the stolen data sold at initial asking prices ranging from $1,500 to $3,500 per database on dark web forums. Security researchers who examined samples confirmed the legitimacy of portions of the stolen material, including credential pairs consistent with the affected user bases and access-restricted source code repositories that were only available to employees of the targeted technology firm. Several of the breached organisations subsequently confirmed the incidents after being contacted by researchers and journalists, while others had not publicly responded at the time the breach was reported. The combination of independently verified samples and the willingness of some victims to acknowledge the incidents lent credibility to the group's claims and established Shiny Hunters, and by extension the Ggumim-associated activity, as a notable actor in the data breach landscape of 2020.

The organisation is publicly identified primarily through its South Korean base of operations and its use of the Shiny Hunters persona, with no additional structural information regarding parent companies, subsidiaries, or formal ownership available in the source material. Its distinguishing characteristic is the combination of large-scale data theft, multi-sector targeting, and direct monetisation of stolen records through dark web marketplaces, which positioned it among the more prolific data leak actors of that period. Beyond the May 2020 incident, the provided record does not detail other operations, products, or services associated with Ggumim, and no quantitative metrics regarding membership, revenue, or operational scale are available.

Incidents

1 incident linked to this organisation.