Cybersecurity articles tagged #ShinyHunters on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/shinyhunters-dark-reading-on-potential-reliaquest-breachhttps://runtimerebel.com/blog/shinyhunters-dark-reading-on-potential-reliaquest-breachDark Reading editors discuss the latest activities of the ShinyHunters threat group, including inquiries into a potential breach affecting ReliaQuest.Fri, 04 Sep 2026 12:24:21 GMTShinyHuntersData BreachCybercrimeThreat IntelligenceDark Readinghttps://runtimerebel.com/blog/shinyhunters-breaches-reliaquest-identity-dashboard-via-phishinghttps://runtimerebel.com/blog/shinyhunters-breaches-reliaquest-identity-dashboard-via-phishingReliaQuest confirms ShinyHunters gained brief, view-only access to its identity dashboard via a sophisticated social engineering attack.Tue, 25 Aug 2026 00:41:55 GMTShinyHuntersSocial EngineeringPhishingCredential TheftOktahttps://runtimerebel.com/blog/reliaquest-thwarts-shinyhunters-social-engineering-attack-on-okta-ssohttps://runtimerebel.com/blog/reliaquest-thwarts-shinyhunters-social-engineering-attack-on-okta-ssoReliaQuest confirms a social engineering attack by ShinyHunters targeting an employee's Okta SSO, blocked from accessing applications or customer data.Mon, 24 Aug 2026 16:25:26 GMTShinyHuntersSocial EngineeringPhishingVishingOktahttps://runtimerebel.com/blog/ringcentral-data-breach-exposes-1-6m-users-to-shinyhuntershttps://runtimerebel.com/blog/ringcentral-data-breach-exposes-1-6m-users-to-shinyhuntersRingCentral data breach impacts 1.6 million users after a sophisticated social engineering attack by ShinyHunters. Names, emails, addresses, and phone numbers exposed.Sat, 15 Aug 2026 16:14:41 GMTShinyHuntersData BreachSocial EngineeringExtortionRingCentralhttps://runtimerebel.com/blog/shinyhunters-breaches-shipmonk-14000-trezor-customers-data-exposedhttps://runtimerebel.com/blog/shinyhunters-breaches-shipmonk-14000-trezor-customers-data-exposedShinyHunters group breached shipping provider ShipMonk, exposing personal data of 14,000 Trezor customers via a Metabase SQL injection vulnerability.Fri, 14 Aug 2026 09:00:29 GMTData BreachShinyHuntersSQL InjectionShipMonkTrezorhttps://runtimerebel.com/blog/shinyhunters-breaches-brinks-home-threatens-data-leakhttps://runtimerebel.com/blog/shinyhunters-breaches-brinks-home-threatens-data-leakShinyHunters claims a breach of Brinks Home systems, threatening to leak stolen data. This analysis covers the threat actor, potential impact, and mitigation.Thu, 30 Jul 2026 17:31:04 GMTShinyHuntersBrinks HomeData BreachData LeakExtortionCybercrimehttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnshttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnsHealth-ISAC warns of increasing ShinyHunters data theft attacks on healthcare and med-tech organizations. Learn about TTPs and critical mitigations.Wed, 29 Jul 2026 20:57:58 GMTShinyHuntersHealthcareData TheftHealth ISACPhishingData Exfiltrationhttps://runtimerebel.com/blog/shinyhunters-claims-ernst-young-hack-analysis-of-third-party-riskshttps://runtimerebel.com/blog/shinyhunters-claims-ernst-young-hack-analysis-of-third-party-risksErnst & Young faces data theft claims from ShinyHunters following a breach of a third-party platform. Learn about the impact and vendor security mitigation.Wed, 29 Jul 2026 06:32:39 GMTShinyHuntersErnst YoungThird Party RiskData ExfiltrationFinancial Serviceshttps://runtimerebel.com/blog/shinyhunters-data-leaks-fuel-2000-sextortion-phishing-campaignhttps://runtimerebel.com/blog/shinyhunters-data-leaks-fuel-2000-sextortion-phishing-campaignScammers are weaponizing personal data from ShinyHunters leaks to launch convincing sextortion campaigns demanding $2,000 in Bitcoin from victims.Sat, 25 Jul 2026 17:00:04 GMTShinyHuntersSextortionPhishingData BreachSocial Engineeringhttps://runtimerebel.com/blog/medtronic-breach-shinyhunters-exfiltrates-3-8m-patient-recordshttps://runtimerebel.com/blog/medtronic-breach-shinyhunters-exfiltrates-3-8m-patient-recordsMedtronic confirms a data breach by ShinyHunters impacting 3.8 million people, exposing personal and protected health information (PHI) from corporate IT systems.Fri, 03 Jul 2026 10:39:14 GMTMedtronicShinyHuntersData BreachHealthcarePHIhttps://runtimerebel.com/blog/medtronic-data-breach-shinyhunters-campaign-exposes-customer-piihttps://runtimerebel.com/blog/medtronic-data-breach-shinyhunters-campaign-exposes-customer-piiMedtronic notifies customers of a data breach linked to ShinyHunters. Learn how cloud credential theft led to the exposure of patient and customer records.Thu, 02 Jul 2026 07:35:29 GMTMedtronicShinyHuntersSnowflakePIICloud Securityhttps://runtimerebel.com/blog/shinyhunters-breach-naic-via-peoplesoft-zero-day-public-data-stolenhttps://runtimerebel.com/blog/shinyhunters-breach-naic-via-peoplesoft-zero-day-public-data-stolenShinyHunters exploited an Oracle PeopleSoft zero-day to breach NAIC, exfiltrating public data, logs, and configuration files. Review PeopleSoft security.Tue, 30 Jun 2026 00:58:15 GMTShinyHuntersNAICOracle PeopleSoftZero-DayData BreachExtortion Grouphttps://runtimerebel.com/blog/nissan-breach-oracle-peoplesoft-zero-day-exploited-by-shinyhuntershttps://runtimerebel.com/blog/nissan-breach-oracle-peoplesoft-zero-day-exploited-by-shinyhuntersNissan discloses a data breach impacting current and former employees, attributed to an exploited Oracle PeopleSoft zero-day vulnerability linked to the ShinyHunters…Tue, 30 Jun 2026 00:57:50 GMTNissanOracle PeopleSoftData BreachShinyHuntersZero-Dayhttps://runtimerebel.com/blog/kodak-data-breach-confirmed-shinyhunters-linked-to-exfiltrationhttps://runtimerebel.com/blog/kodak-data-breach-confirmed-shinyhunters-linked-to-exfiltrationKodak acknowledges a data breach after ShinyHunters claimed responsibility, with the threat actor reportedly exfiltrating sensitive company information.Thu, 18 Jun 2026 09:50:54 GMTKodakShinyHuntersData BreachExfiltrationCyberattackhttps://runtimerebel.com/blog/shinyhunters-exploits-oracle-erp-zero-day-to-breach-higher-edhttps://runtimerebel.com/blog/shinyhunters-exploits-oracle-erp-zero-day-to-breach-higher-edShinyHunters is exploiting an unpatched zero-day vulnerability in Oracle ERP software, targeting US higher education institutions for data theft.Sat, 13 Jun 2026 05:36:54 GMTShinyHuntersOracle ERPZero-DayHigher EducationData Thefthttps://runtimerebel.com/blog/cve-2026-35273-oracle-peoplesoft-rce-exploited-as-zero-day-by-shinyhuntershttps://runtimerebel.com/blog/cve-2026-35273-oracle-peoplesoft-rce-exploited-as-zero-day-by-shinyhuntersMandiant and GTIG identified ShinyHunters (UNC6240) exploiting CVE-2026-35273, a critical RCE in Oracle PeopleSoft, targeting higher education.Fri, 12 Jun 2026 09:42:34 GMTShinyHuntersUNC6240Oracle PeopleSoftCVE-2026-35273Zero-DayRCEHigher Educationhttps://runtimerebel.com/blog/oracle-peoplesoft-rce-via-cve-2026-35273-mitigation-guidehttps://runtimerebel.com/blog/oracle-peoplesoft-rce-via-cve-2026-35273-mitigation-guideShinyHunters (UNC6240) exploited an Oracle PeopleSoft zero-day (CVE-2026-35273) to breach university networks and exfiltrate data for extortion purposes.Thu, 11 Jun 2026 20:55:48 GMTCVE-2026-35273ShinyHuntersOracle PeopleSoftUNC6240Extortionhttps://runtimerebel.com/blog/cve-2024-21319-peoplesoft-auth-bypass-exploited-by-shinyhuntershttps://runtimerebel.com/blog/cve-2024-21319-peoplesoft-auth-bypass-exploited-by-shinyhuntersOracle PeopleSoft zero-day CVE-2024-21319, an authentication bypass, is being actively exploited by ShinyHunters. Patch PeopleSoft 8.59, 8.60, 8.61 now.Thu, 11 Jun 2026 17:25:15 GMTCVE-2024-21319PeopleSoftOracleShinyHuntersAuthentication BypassZero-DayCPUhttps://runtimerebel.com/blog/university-of-nottingham-confirms-breach-after-shinyhunters-data-leakhttps://runtimerebel.com/blog/university-of-nottingham-confirms-breach-after-shinyhunters-data-leakThe University of Nottingham confirms a data breach after the ShinyHunters group leaked over 450,000 records, highlighting risks to academic data security.Thu, 11 Jun 2026 09:39:20 GMTShinyHuntersUniversity of NottinghamHigher EducationData ExfiltrationPII Leakhttps://runtimerebel.com/blog/shinyhunters-leak-234-gb-of-dentaquest-data-impacting-2-6-millionhttps://runtimerebel.com/blog/shinyhunters-leak-234-gb-of-dentaquest-data-impacting-2-6-millionThe ShinyHunters extortion group leaked 234 GB of data from DentaQuest, impacting 2.6 million individuals. Learn about the risks and how to protect PHI.Fri, 05 Jun 2026 13:14:00 GMTShinyHuntersDentaQuestData LeakExtortionHealthcare Securityhttps://runtimerebel.com/blog/charter-communications-data-breach-millions-of-records-exposedhttps://runtimerebel.com/blog/charter-communications-data-breach-millions-of-records-exposedShinyHunters leaked data allegedly from Charter Communications, potentially exposing nearly 5 million customer records. Organizations must assess third-party risk.Fri, 29 May 2026 17:20:56 GMTShinyHuntersCharter CommunicationsData BreachExtortionData Leakhttps://runtimerebel.com/blog/charter-communications-data-breach-4-9-million-accounts-exposedhttps://runtimerebel.com/blog/charter-communications-data-breach-4-9-million-accounts-exposedCharter Communications confirms a data breach affecting 4.9 million customer accounts after an extortion group targeted a third-party vendor's environment.Fri, 29 May 2026 09:18:18 GMTCharter CommunicationsSpectrumShinyHuntersData BreachThird Party Riskhttps://runtimerebel.com/blog/charter-data-breach-confirmed-shinyhunters-extortion-threathttps://runtimerebel.com/blog/charter-data-breach-confirmed-shinyhunters-extortion-threatCharter Communications confirms a data breach following an extortion threat by ShinyHunters.Tue, 26 May 2026 20:46:11 GMTCharter CommunicationsShinyHuntersData BreachExtortionTelecommunicationsThird Party Riskhttps://runtimerebel.com/blog/7-eleven-data-breach-185000-records-leaked-by-shinyhuntershttps://runtimerebel.com/blog/7-eleven-data-breach-185000-records-leaked-by-shinyhuntersAnalysis of the 7-Eleven data breach involving threat actor ShinyHunters, impacting 185,000 users and exposing sensitive PII including dates of birth.Tue, 26 May 2026 13:13:00 GMT7 ElevenShinyHuntersPII LeakData BreachIdentity Thefthttps://runtimerebel.com/blog/security-brief-data-breaches-shinyhunters-activity-and-app-flawshttps://runtimerebel.com/blog/security-brief-data-breaches-shinyhunters-activity-and-app-flawsAnalyzes recent security events: Nvidia cloud gaming data breach, FBI warning on ShinyHunters hacking Canvas, and critical flaws in Audi mobile applications.Fri, 15 May 2026 16:42:44 GMTNVIDIAShinyHuntersAudiData BreachMobile SecurityCloud GamingFBIhttps://runtimerebel.com/blog/us-house-committee-probes-instructure-following-canvas-cyberattackshttps://runtimerebel.com/blog/us-house-committee-probes-instructure-following-canvas-cyberattacksThe House Committee on Homeland Security seeks testimony from Instructure after the ShinyHunters group targeted the Canvas LMS, compromising student data.Wed, 13 May 2026 00:53:18 GMTInstructureCanvasShinyHuntersHomeland SecurityStudent Datahttps://runtimerebel.com/blog/shinyhunters-extorts-instructure-3-65tb-canvas-lms-data-breach-analysishttps://runtimerebel.com/blog/shinyhunters-extorts-instructure-3-65tb-canvas-lms-data-breach-analysisInstructure reaches an agreement with ShinyHunters after a massive 3.65TB data breach affecting Canvas LMS users across thousands of educational institutions.Tue, 12 May 2026 09:05:00 GMTInstructureCanvas LMSShinyHuntersData ExtortionEducation Sectorhttps://runtimerebel.com/blog/shinyhunters-claims-second-attack-against-instructure-pii-at-riskhttps://runtimerebel.com/blog/shinyhunters-claims-second-attack-against-instructure-pii-at-riskThe threat actor ShinyHunters has launched a second attack against Instructure, putting the PII of hundreds of millions of EdTech users at immediate risk.Sat, 09 May 2026 00:50:39 GMTShinyHuntersInstructureCanvas LMSData BreachPII Leakhttps://runtimerebel.com/blog/shinyhunters-defaces-canvas-login-portals-in-extortion-campaignhttps://runtimerebel.com/blog/shinyhunters-defaces-canvas-login-portals-in-extortion-campaignShinyHunters breached Instructure, defacing Canvas login portals for numerous educational institutions, potentially impacting user credentials and initiating extortion.Fri, 08 May 2026 00:50:31 GMTShinyHuntersInstructureCanvas LMSExtortionEducation SectorDefacementCredential Thefthttps://runtimerebel.com/blog/instructure-data-breach-shinyhunters-exposes-education-sector-vendor-riskhttps://runtimerebel.com/blog/instructure-data-breach-shinyhunters-exposes-education-sector-vendor-riskAnalysis of the Instructure data breach by ShinyHunters, impacting educational institutions using Canvas LMS and highlighting critical third-party vendor dependencies.Thu, 07 May 2026 00:51:22 GMTInstructureCanvas LMSShinyHuntersEducation SectorData BreachThird Party RiskVendor Securityhttps://runtimerebel.com/blog/instructure-data-breach-shinyhunters-claims-theft-of-employee-datahttps://runtimerebel.com/blog/instructure-data-breach-shinyhunters-claims-theft-of-employee-dataEducational technology giant Instructure confirms an internal data breach after the ShinyHunters threat group claims to have stolen sensitive corporate data.Mon, 04 May 2026 00:50:54 GMTInstructureShinyHuntersCanvas LMSData BreachExtortionhttps://runtimerebel.com/blog/medtronic-data-breach-shinyhunters-claims-9-million-records-stolenhttps://runtimerebel.com/blog/medtronic-data-breach-shinyhunters-claims-9-million-records-stolenMedtronic confirms a security breach after the ShinyHunters threat group claims to have exfiltrated 9 million records containing personal information.Tue, 28 Apr 2026 08:57:57 GMTMedtronicShinyHuntersData BreachPII TheftMedical Technologyhttps://runtimerebel.com/blog/adt-confirms-data-breach-amid-shinyhunters-extortion-threathttps://runtimerebel.com/blog/adt-confirms-data-breach-amid-shinyhunters-extortion-threatADT confirms a data breach following a ShinyHunters extortion attempt. Customer data is at risk; security professionals must advise enhanced vigilance.Sat, 25 Apr 2026 00:43:18 GMTADTShinyHuntersData BreachExtortionCybercrimeThreat Intelligencehttps://runtimerebel.com/blog/vercel-data-breach-shinyhunters-claim-theft-of-next-js-creator-datahttps://runtimerebel.com/blog/vercel-data-breach-shinyhunters-claim-theft-of-next-js-creator-dataVercel confirms a security incident following claims by ShinyHunters to sell stolen data for $2 million. Analyze the impact on Next.js and supply chains.Mon, 20 Apr 2026 08:54:09 GMTVercelNext JsShinyHuntersData BreachSupply Chain Securityhttps://runtimerebel.com/blog/mcgraw-hill-data-breach-13-5-million-accounts-leaked-by-shinyhuntershttps://runtimerebel.com/blog/mcgraw-hill-data-breach-13-5-million-accounts-leaked-by-shinyhuntersThreat actor ShinyHunters leaks 13.5 million McGraw Hill user records following a Salesforce environment breach. Includes password hashes and PII.Thu, 16 Apr 2026 12:33:08 GMTMcGraw HillShinyHuntersSalesforce BreachData LeakCredential Harvestinghttps://runtimerebel.com/blog/rockstar-games-analytics-data-leaked-via-shinyhunters-extortionhttps://runtimerebel.com/blog/rockstar-games-analytics-data-leaked-via-shinyhunters-extortionRockstar Games analytics data has been leaked by the ShinyHunters group following a breach at third-party provider Anodot. Analysis of the supply chain risk.Mon, 13 Apr 2026 20:25:13 GMTRockstar GamesShinyHuntersAnodotData LeakSupply Chainhttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-cisco-source-code-stolen-unc6780-activityhttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-cisco-source-code-stolen-unc6780-activityAnalysis of the TeamPCP supply chain campaign, including the theft of Cisco source code and over 1,000 compromised SaaS environments tracked by Google GTIG as UNC6780.Thu, 09 Apr 2026 00:37:07 GMTTeamPCPUNC6780Supply Chain AttackCiscoSource Code TheftTrivyShinyHuntersSaaS Compromisehttps://runtimerebel.com/blog/wynn-resorts-breach-21000-employees-impacted-by-shinyhuntershttps://runtimerebel.com/blog/wynn-resorts-breach-21000-employees-impacted-by-shinyhuntersCasino operator Wynn Resorts confirms a data breach affecting 21,000 employees following an extortion attempt by the ShinyHunters threat group.Tue, 07 Apr 2026 08:34:56 GMTWynn ResortsShinyHuntersEmployee DataPII ExposureExtortionhttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-escalate-amidst-hacker-infightinghttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-escalate-amidst-hacker-infightingRuntime Rebel details how TeamPCP's supply chain attacks are leading to breaches, with ShinyHunters and Lapsus$ adding to the chaos.Fri, 03 Apr 2026 16:18:40 GMTTeamPCPShinyHuntersLapsusSupply Chain AttackBreachThreat Actorhttps://runtimerebel.com/blog/shinyhunters-breach-european-commission-cloud-data-thefthttps://runtimerebel.com/blog/shinyhunters-breach-european-commission-cloud-data-theftShinyHunters claimed responsibility for a cyber intrusion and 350GB data theft from European Commission cloud systems. Understand the TTPs and mitigation.Mon, 30 Mar 2026 12:35:44 GMTShinyHuntersEuropean CommissionData TheftCloud SecurityCyber IntrusionExfiltrationhttps://runtimerebel.com/blog/european-commission-confirms-europa-eu-data-breach-by-shinyhuntershttps://runtimerebel.com/blog/european-commission-confirms-europa-eu-data-breach-by-shinyhuntersThe European Commission confirms a data breach of the Europa.eu platform after the ShinyHunters group claimed the theft of 1.2 GB of internal database records.Mon, 30 Mar 2026 08:41:32 GMTShinyHuntersEuropean CommissionEuropa EuData Extortionhttps://runtimerebel.com/blog/mitre-att-ck-governance-and-predator-spyware-ios-evasion-tacticshttps://runtimerebel.com/blog/mitre-att-ck-governance-and-predator-spyware-ios-evasion-tacticsAnalysis of the new MITRE ATT&CK Advisory Council, Predator spyware bypassing iOS indicators, and Russian cyber-kinetic operation coordination.Fri, 27 Feb 2026 16:16:27 GMTMITRE ATT CKPredator SpywareiOS SecurityGRUShinyHuntersOdidohttps://runtimerebel.com/blog/wynn-resorts-confirms-employee-data-breach-linked-to-shinyhuntershttps://runtimerebel.com/blog/wynn-resorts-confirms-employee-data-breach-linked-to-shinyhuntersWynn Resorts confirms a data breach affecting employee information after the ShinyHunters group removed stolen records from a dark web leak site.Wed, 25 Feb 2026 12:27:36 GMTWynn ResortsShinyHuntersData BreachBreachForumsHospitality SectorPII Thefthttps://runtimerebel.com/blog/wynn-resorts-data-breach-shinyhunters-exfiltrates-employee-piihttps://runtimerebel.com/blog/wynn-resorts-data-breach-shinyhunters-exfiltrates-employee-piiWynn Resorts confirms a data breach impacting employee PII, attributed to the ShinyHunters extortion gang. Analysis covers TTPs and mitigation strategies.Wed, 25 Feb 2026 04:42:06 GMTWynn ResortsShinyHuntersData BreachEmployee DataExtortionPIIhttps://runtimerebel.com/blog/shinyhunters-claims-breach-of-odido-telecom-affecting-millionshttps://runtimerebel.com/blog/shinyhunters-claims-breach-of-odido-telecom-affecting-millionsThe ShinyHunters extortion group claims to have exfiltrated millions of customer records from Dutch telecommunications provider Odido via a third-party breach.Tue, 24 Feb 2026 12:22:55 GMTShinyHuntersOdidoTelecommunicationsData ExfiltrationBreachForums