ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Report
Search
Home > List all groups > ShinyHunters

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Other threat group: ShinyHunters

NamesShinyHunters (self given)
Country[Unknown]
MotivationFinancial gain
First seen2020
Description(ZeroFOX) ShinyHunters is taking a page out of the book of Gnosticplayers, the breach data broker who in 2018-2019 pilfered billions of records from dozens of companies and sold them online. Due to the verification of the Tokopedia breach by multiple researchers and the company itself, ZeroFOX Alpha Team has HIGH confidence that these new breaches are legitimate, and will most likely be available on other breach marketplaces at lower prices in the near future. It is likely that this actor will continue to breach companies and post their content for sale. These tactics proved both successful and profitable for gnosticplayers, and it is likely they will continue to appeal to other breach brokers for these reasons.
Observed
Tools used
Operations performedJan 2020Hacker leaks 40 million user records from popular Wishbone app
<https://www.zdnet.com/article/hacker-selling-40-million-user-records-from-popular-wishbone-app/>
Jan 202025 million user records leak online from popular math app Mathway
<https://www.zdnet.com/article/25-million-user-records-leak-online-from-popular-math-app-mathway/>
Mar 2020Hacker leaks 15 million records from Tokopedia, Indonesia's largest online store
<https://www.zdnet.com/article/hacker-leaks-15-million-records-from-tokopedia-indonesias-largest-online-store/>
Mar 2020A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer has learned.
<https://www.bleepingcomputer.com/news/security/microsofts-github-account-hacked-private-repositories-stolen/>
Mar 2020Hackers sell stolen user data from HomeChef, ChatBooks, and Chronicle
<https://www.bleepingcomputer.com/news/security/hackers-sell-stolen-user-data-from-homechef-chatbooks-and-chronicle/>
May 2020Online learning platform Unacademy has suffered a data breach after a hacker gained access to their database and started selling the account information for close to 22 million users.
<https://www.bleepingcomputer.com/news/security/hacker-sells-22-million-unacademy-user-records-after-data-breach/>
Jun 2020Havenly discloses data breach after 1.3M accounts leaked online
<https://www.bleepingcomputer.com/news/security/havenly-discloses-data-breach-after-13m-accounts-leaked-online/>
Jul 2020An allegedly stolen Wattpad database containing 270 million records were being sold in private sales for over $100,000. Now it is being offered for free on hacker forums.
<https://www.bleepingcomputer.com/news/security/wattpad-data-breach-exposes-account-info-for-millions-of-users/>
Jul 2020Tech unicorn Dave admits to security breach impacting 7.5 million users
<https://www.zdnet.com/article/tech-unicorn-dave-admits-to-security-breach-impacting-7-5-million-users/>
Jul 2020Promo.com discloses data breach after 22M user records leaked online
<https://www.bleepingcomputer.com/news/security/promocom-discloses-data-breach-after-22m-user-records-leaked-online/>
Nov 2020ShinyHunters hacker leaks 5.22GB worth of Mashable.com database
<https://www.hackread.com/shinyhunters-hacker-leaks-mashable-database/>
Nov 2020Popular stock photo service hit by data breach, 8.3M records for sale
<https://www.bleepingcomputer.com/news/security/popular-stock-photo-service-hit-by-data-breach-83m-records-for-sale/>
Nov 2020Hacker posts 1.9 million Pixlr user records for free on forum
<https://www.bleepingcomputer.com/news/security/hacker-posts-19-million-pixlr-user-records-for-free-on-forum/>
Jan 2021Hacker leaks full database of 77 million Nitro PDF user records
<https://www.bleepingcomputer.com/news/security/hacker-leaks-full-database-of-77-million-nitro-pdf-user-records/>
Jan 2021Hacker leaks data of millions of Teespring users
<https://www.zdnet.com/article/hacker-leaks-data-of-millions-of-teespring-users/>
Jan 2021Bonobos clothing store suffers a data breach, hacker leaks 70GB database
<https://www.bleepingcomputer.com/news/security/bonobos-clothing-store-suffers-a-data-breach-hacker-leaks-70gb-database/>
Jan 2021Hacker leaks data of 2.28 million dating site users
<https://www.zdnet.com/article/hacker-leaks-data-of-2-28-million-dating-site-users/>
<https://www.riskbasedsecurity.com/2021/01/25/shinyhunters-wave-3-one-hacker-exposes-over-125-million-credentials/>
Apr 2021Shifting Strategies: ShinyHunters and Known Cyber Threat Actors Change Tactics
<https://www.riskbasedsecurity.com/2021/04/21/shifting-strategies-shinyhunters-and-known-cyber-threat-actors-change-tactics/>
Apr 2021ShinyHunters dump partial database of broker firm Upstox
<https://www.hackread.com/shinyhunters-broker-firm-upstox-database-leak/>
Apr 2021Hacker leaks 20 million alleged BigBasket user records for free
<https://www.bleepingcomputer.com/news/security/hacker-leaks-20-million-alleged-bigbasket-user-records-for-free/>
May 2021ShinyHunters leak database of Indian wedding portal WedMeGood
<https://www.hackread.com/shinyhunters-leak-india-wedmegood-database/>
Dec 2021This time, the victim is a Fortune India 500 List company: Mumbai-headquartered Aditya Birla Group (ABG).
<https://www.databreaches.net/major-indian-fashion-retailer-hacked-and-data-leaked/>
Counter operationsJun 2022Alleged member of ShinyHunters held in Morocco on Interpol Red Notice, U.S. seeking extradition
<https://www.databreaches.net/alleged-member-of-shinyhunters-held-in-morocco-on-interpol-red-notice-u-s-seeking-extradition-reports/>
Information<https://www.zerofox.com/blog/shinyhunters-breach/>
<https://www.bleepingcomputer.com/news/security/hacker-group-floods-dark-web-with-data-stolen-from-11-companies/>
<https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/>
<https://www.bleepingcomputer.com/news/security/hacker-leaks-386-million-user-records-from-18-companies-for-free/>
<https://www.bankinfosecurity.com/anatomy-breach-criminal-data-brokers-hit-dave-a-14715>
<https://www.bankinfosecurity.com/blogs/data-breaches-shinyhunters-dominance-continues-p-2998>

Last change to this card: 12 September 2022

Download this actor card in PDF or JSON format

Previous: Shadow Brokers
Next: Shark Spider

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]