SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

shinyhunters

34 Einträge insgesamt

Zeitraum: 18.08.2026 – 02.10.2026

Veröffentlichungskanäle

  • Leak-Seite · SH · zuletzt nicht erreichbar
  • Leak-Seite · shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion · zuletzt nicht erreichbar
  • Dateiablage · // SH · zuletzt erreichbar
  • Leak-Seite · zuletzt erreichbar
  • Leak-Seite · [sh] shinyhunters · zuletzt nicht erreichbar
  • Dateiablage · zuletzt erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Meldungen, die den Gruppennamen neben einem Fachbegriff nennen. Kein Maß für die Schwere eines Vorfalls und kein Beleg, dass ein bestimmtes Opfer in der Presse stand.

Neueste Einträge

Filter zurücksetzen
shinyhuntersDexCom, Inc.—

Beschreibung der Täter

Data is being published by end of day Friday if you do not reach out to us. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersO'Reilly Automotive—
automotive

Beschreibung der Täter

Data is being published by end of day Friday if you do not reach out to us. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersWARNING—

Beschreibung der Täter

Due to certain disinformation spreading once again, we are releasing this statement to confirm we are okay, our operations and infrastructure remains completely fine as it should be and WILL be. The organizations who have been in negotiations with us who believe we are falling apart is WRONG! We are eagerly waiting to make examples of those organizations who think they may have gotten a free pass into not paying us few tens of millions of dollars. To those organizations speaking to us, your data is still in our possession and at risk of being published, there is still an option to prevent that from happening, go back to being serious again in our discussions. Thank you for your attention to this matter. -SH

Herkunft

shinyhuntersFinal statement re PSA—

Beschreibung der Täter

Good afternoon, We have no further comments to make regarding our PSA statement we released the other day. Our organisation is highly confident we have achieved our goal and our intentions we repeatedly made clear to journalists and in our public statements. There is 5 days remaining still. We have no comment yet regarding what we will do if the victim entity does not comply with our kind request. Nonetheless, we got what we wanted and we have a business to run and operate as usual. We will not be responding to any press inquiries about this and we will not be sharing updates about other datasets we have that we did not yet disclose to the public. We reiterate and want to assiduously emphasise we are NOT extorting the victim in question, this is NOT financially motivated and this is NOT a ransom. Thank you for your time and attention to this matter. This is now old news. Regards, SH

Herkunft

shinyhuntersPRESS RELEASE RE PSAUS

Beschreibung der Täter

We are currently not distributing samples to any media agencies. Furthermore, our policy restricts sharing these materials strictly to established, mainstream agencies. You know who you are. We initially provided samples to a select group of prominent U.S. media organizations solely to verify our claims, mainly operating under the assumption that they would handle the sensitive sample data responsibly. We explicitly told each journalist we shared samples with to NOT share the sample file with others and to explicitly delete the sample data after they complete their assessment. Due to the high sensitivity of this situation, one or more of the journalists involved shared these samples with a security researcher that we are aware of. In our experience, security researchers are both white and blackhats. We believe that security researcher is going to share it with his counterparts. That security researcher has made a YouTube video bragging about how he has the sample data. We keep a strict circle and control over the things we do. Our allegation here is accurate. If the 5,000 sample data records leak, it's not because of us, it's because of any journalist who exercised bad practice an

Herkunft

shinyhuntersFresenius Medical Care—
healthcare

Beschreibung der Täter

You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026

Herkunft

shinyhuntersPSA - READ THIS NOWUS

Beschreibung der Täter

Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended. We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to "disrupt" our operations, an effort that ultimately proved unsuccessful. For us to properly address and correct these unfounded allegations, we were compelled to adopt a forceful and assertive posture to ensure our response was fully acknowledged. This PSA today does just that. Our PSA today works to address these allegations and correct them. We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job. Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more. We are willing to allow you a time of 1 week to correct or simply REMOVE the 2026 Quarter 2 FLASH report on us that include

Herkunft

shinyhuntersNote to Cl0p-_-—

Beschreibung der Täter

IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: Email us from your official email at shinygroup@onionmail.com and lets see how rich you really are. 2.333% of my networth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism.

Herkunft

shinyhuntersQi****—
kein Firmenname im Eintrag

Beschreibung der Täter

Processing publication of this company unless they start negotiating appropriately. Deadline: 18 Sep 2026

Herkunft

shinyhuntersKimberly-Clark—

Beschreibung der Täter

This is a final warning to reach out by 16 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersState of Florida DMVUS

Beschreibung der Täter

Contact us, you know how. or we will release the files. View download button below for proof (samples). Deadline : 9 11 2026

Herkunft

shinyhuntersMedela.com—

Beschreibung der Täter

This is a final warning to reach out by 08 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersNote to mr. databroker1 NEXUS DL Service—

Beschreibung der Täter

We've been trying to get ahold of you. We've made you several large offers for the data you possess (DL data). We don't believe you've seen them. I think you will appreciate the numbers we have to offer you in return for the data you possess. What we are willing to offer you can be considered a payment as large as what you would get paid in a ransom. Reply to the DMs we are sending you on forum or simply contact shinygroup@onionmail.com

Herkunft

shinyhuntersNeoGen Corporation—

Beschreibung der Täter

Over 5 million Salesforce records compromised containing some PII and 541GB+ of Sharepoint internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersNeogen Corporation—

Beschreibung der Täter

This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersMcKesson Corporation—

Beschreibung der Täter

Hundreds of millions of records/rows of data was compromised containing very sensitive information spanning from PII to PHI. We urge you to reach out. Read our emails. We will provide a substanial discount. Failure to engage with us will result in the full publication of data taken from you and we very much intend to carry that out if you do not engage with us. This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersElekta AB—

Beschreibung der Täter

This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersJack Henry & Associates—

Beschreibung der Täter

This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersCyrusOne, LLC.—

Beschreibung der Täter

Update 23 Aug: We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records along with: Sharepoint: (369.6 GB Compressed / 645 GB Uncompressed) 288,729 Files, 60,513 Folders - More than 182,000 rows of Customer data Extracted from the "Contacts" Salesforce Object. - Over 8,300 Rows of Employee PII (Full Name, Email, Job Title, Phone Number, ect.) - Thousands of executed contracts, MSAs, NDAs, amendments, leases, and SOWs - Extensive physical key inventory logs, verification photos, and contractor Green Badge audits - Large collection of data center drawings, floor plans, electrical one-line diagrams, security system drawings, and site schematics - Full CERM (Critical Environment Reliability Management) process library - Physical and information security policy suite plus governance materials - Regional security scorecards, KPI workbooks, GAM sheets, and signed performance packages - Credential and access-control artifacts (including PasswordList.xlsx, Okta SSC Access lists, active badge reports, and multiple Data Center Access Control forms)This is a final warning

Herkunft

shinyhuntersReliaQuest, LLC—

Beschreibung der Täter

This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for informational purposes only. We do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this post. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favour by us.

Herkunft

shinyhuntersNovoCure Limited—

Beschreibung der Täter

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersBOK Financial—
finanzen

Beschreibung der Täter

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersCyrus******—
kein Firmenname im Eintrag

Beschreibung der Täter

This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersLogitech/ Streamlabs—

Beschreibung der Täter

This is a final warning to reach out by 21 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

shinyhuntersBrinks Home—

Beschreibung der Täter

Over 4.9 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersAlcon, Inc.—

Beschreibung der Täter

Over 25 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersLumenis Ltd.—

Beschreibung der Täter

Over 1.1 million records containing some PII of customers/employees and 177GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersQuestel SAS—

Beschreibung der Täter

Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersMetabase—

Beschreibung der Täter

:P

Herkunft

shinyhuntersSharecare, Inc.—

Beschreibung der Täter

This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for you, that is on you. We will be publishing companies data who are negotiating with us, without a warning if negotiators continue to take us as misinformed individuals and BS us. Over 3.4 million Salesforce records containing some PII and 28GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersNOTICE OF WARNING—

Beschreibung der Täter

We are currently experiencing an influx of volume. More leaks are on their way. Kindly be informed, it is in your best interests to not stall and waste our time. Just pay and get it over with. We are on short temper and patience. We are the ones with the leverage, not you. Don't be naive. If you aren't with the program, go away. Your data will be published immediately and accordingly. SH

Herkunft

shinyhuntersCarhartt, Inc.—

Beschreibung der Täter

Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempted to negotiate with us The Company would've ended up saving a good chunk of money. Instead they decided to do (see blow); this is also because The Company hired a very unskilled and incompetent negotiator. If The Company hired competency to negotiate for them, this post would've never been published. [21:24:22] carhartt: After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions. We appreciate your patience throughout this process. There is millions of customers of data involved here. As we always say, these companies don't care. Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersCook Medical LLC—
healthcare

Beschreibung der Täter

Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers, did not want to pay what we asked for and decided they are okay with the data leak to happen instead of increasing their offer by a little, then we'd likely have accepted and this post would not have gone up. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care.

Herkunft

shinyhuntersBaxter International, Inc.—

Beschreibung der Täter

Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.