ShinyHunters

Profile narrative

ShinyHunters, also known as ShinyHunters Collective or Shiny Hunters, is a cybercriminal organisation that emerged on the threat landscape by monetising stolen data from high-profile corporate breaches. Operating primarily through dark web marketplaces, the group specialises in obtaining, advertising, and selling large datasets containing sensitive user information. Their activities involve leaking or selling compromised databases sourced from multiple organisations across different sectors and geographies, with offerings including user records, credentials, and personally identifiable information. The group has demonstrated a capacity to target diverse industries, ranging from e-commerce and food delivery to technology and media, positioning itself as a notable player in the illicit trade of stolen data.

The group's operational scale became particularly visible in May 2020, when ShinyHunters leaked and sold stolen data from multiple companies, reportedly affecting over 73 million user records across eleven organisations. Victims included an Indonesian online store, an Indian e-learning platform, Microsoft's private GitHub repositories, a meal delivery service, a photo printing platform, and a news outlet. The compromised data encompassed emails, hashed passwords, social media tokens, IP addresses, and partial social security numbers, indicating the breadth of information the group was able to obtain and subsequently commercialise. Cybersecurity firms analysing the breaches assessed the data as legitimate, lending credibility to the group's offerings on dark web markets, where databases were priced between $1,500 and $3,500.

ShinyHunters operates from Indonesia, according to the available contextual information, and has signalled intentions to release additional stolen datasets following their initial wave of activity. Their distinguishing attribute lies in the volume and diversity of their targets, as well as their willingness to openly advertise and auction compromised data through underground forums. Rather than focusing on a single sector or region, the group has pursued a broad targeting strategy, affecting both private sector companies and platforms tied to major technology providers. This pattern reflects a business model centred on the aggregation and resale of stolen credentials and user information, leveraging reputational damage and regulatory exposure of victims to maximise the perceived value of their illicit offerings.

Incidents

1 incident linked to this organisation.