Overview
ShinyHunters is a prolific cybercriminal extortion group specializing in large-scale data theft, selling stolen data on dark web forums, and retaliatory attacks against organizations that publish law-enforcement advisories about the group.
2026 Incident: Alleged Leader Arrest (Sep 15–29)
- 2026-09-15: Dutch police arrested 24-year-old pepijn-van-der-stap in Amsterdam; devices seized (2026-09-29-shinyhunters-bleepingcomputer-arrest)
- 2026-09-29: Rotterdam court ordered 90-day pretrial detention; laptop evidence of alleged murder-solicitation abroad under separate probe (2026-09-29-shinyhunters-hacker-arrest-murder-plot)
- FBI Cyber Division lead Brett Leatherman confirmed arrest; group denies association with suspect
- Linked to breaches of Ticketmaster, AT&T, FBI careers portal (140+ org victims claimed)
Leadership attribution is alleged — ShinyHunters denies link. Murder charges under separate investigation from cybercrime case.
Known Activities
- Data theft and extortion via dark web leak sites
- Oracle PeopleSoft exploitation (claimed zero-days)
- Retaliation against FBI FLASH reports
- Supply chain and cloud pivot (AWS GovCloud claims)
2026 Incident: Alleged FBI Breach (Sep 22–Oct)
- Claim: Breached FBI via Oracle PeopleSoft zero-day; lateral movement to AWS GovCloud; 2–3 TB stolen (agents + applicants)
- Confirmed: FBI jobs portal down; FBI investigating; internal memo tells staff to assume PII stolen (2026-10-02-fbi-shinyhunters-breach-decrypt)
- Unconfirmed: Full data volume, PeopleSoft zero-day (Oracle silent; Reuters verified 22+ sample records)
- Motive: Retaliation for May 2026 FBI FLASH report; one-week retraction deadline passed; group says it will not publish data
- Context: Ars Oct 2026 synthesis pairs with separate dmdc breach — no established link (2026-10-01-federal-agencies-hacks-sensitive-data)
Treat breach scope as alleged until FBI/Oracle confirm. Do not reproduce PII from samples.
2026 Incident: Vercel Breach (April)
- Method: Compromised Context.ai OAuth integration
- Data: Customer environment variables, API keys
- Outcome: Vercel engaged Mandiant and law enforcement