ShinyHunters

The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July. The data breach details were exposed, according to the data breach notification service Have I Been Pwned.

The article highlights recent cybersecurity threats and updates, including fake Fortnite rewards stealing accounts, the AtlasRAT malware via fake Flash Player installs, and Hims & Hers facing lawsuits over data privacy failures. It also covers Apple's AI worm issue, a $1.8 million crypto app scam, and vulnerabilities in the Vatican's Click To Pray app exposing 700,000 users' data. Malwarebytes announces new security tools and updates.

A fake sextortion email claiming to represent ShinyHunters demanded $2,000 in Litecoin from Wayne P. of Louisiana, using data from the 2026 Carnival Corporation breach to appear credible. The FBI warns such emails often fabricate claims about device access and recordings, while the Carnival breach exposed personal information like names, addresses, and government IDs.

Sextortion scammers are using email addresses from ShinyHunters data leaks to craft threatening emails demanding $2,000 in Bitcoin, falsely claiming to have recorded victims via webcam. The scammers impersonate ShinyHunters, but the group denies involvement, and no evidence supports the claims. Data breaches from companies like Amtrak, Hallmark, and ADT are being exploited in the campaign.

Threat actors are leveraging email addresses from data breaches exposed by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin.

A class action lawsuit was filed in Illinois federal court against Abbott Laboratories and its subsidiary Exact Sciences over a data breach involving unauthorized access to patient information. The breach, attributed to cybercriminal group ShinyHunters via a voice phishing attack, exposed sensitive data including Social Security numbers, email addresses, and physical addresses from at-home cancer screening tests.

Healthcare company Abbott is investigating two cyber incidents involving unauthorized access to its Cancer Diagnostics business and LabCentral portal. Cybercriminal groups ShinyHunters and ShadowByt3$ claim extensive data breaches, including sensitive patient information, but Abbott denies significant impact on operations or data exposure.

Madison Square Garden Entertainment sued WIRED magazine over a report alleging the venue maintains a secret database tracking celebrity 'risk scores' and LGBTQ identities. WIRED claims it used stolen data to expose alleged discrimination, while MSG argues the data was for standard relationship management. Both sides have vowed to defend their positions in court.

Attackers linked to ShinyHunters accessed corporate Salesforce environments over a year by exploiting OAuth connections rather than platform vulnerabilities. Microsoft Maps tracked the theft across three paths without any flaws in Salesforce being exploited.

Donna Sanders filed a class action against One Medical, alleging a data breach exposed patients' personal and medical information to cybercriminals. The breach, attributed to One Medical's inadequate security measures, occurred from June 8 to 11 and involved the cybercriminal group ShinyHunters.

Healthcare device company Medtronic is notifying affected customers about a data breach that exposed their personal information to an unauthorized third party. The breach is linked to ShinyHunters, a hacker group.

Malwarebytes Labs reported cleaning nearly 15,000 infected websites in a SocGholish crackdown. Apple patched a Beats Studio Buds vulnerability, Microsoft addressed the RoguePlanet flaw, and retro gaming fans faced fake GitHub malware. Kodak confirmed a breach linked to ShinyHunters, Roblox developers lost games to malware, and 24 billion records were exposed online. Malwarebytes received AV-TEST awards for its security solutions.

Kodak has confirmed a data breach claimed by the ShinyHunters extortion gang and is working with external cybersecurity experts to investigate. Hackers gained access to some of the company's data.

The FCC aims to restrict burner phones, Microsoft released a major security update linked to AI bug hunting, and the ShinyHunters ransomware group exploited an Oracle zero-day vulnerability.

ShinyHunters exploited a zero-day vulnerability in Oracle's ERP software to steal data from American universities. The attack took advantage of a critical bug that disproportionately impacted higher education institutions.

ShinyHunters exploited an unpatched Oracle PeopleSoft zero-day (CVE-2026-35273) to breach enterprise systems, targeting universities most severely. Google's Mandiant linked the attacks to UNC6240, with activity occurring between May 27 and June 9, just one day before Oracle released its security advisory on June 10.

The ShinyHunters hacking gang claims to have compromised the Oracle PeopleSoft servers of more than 100 organizations, including many universities.

Oxford University's CareerConnect platform, managed by Group GTI, suffered a data breach exposing users' full names and email addresses, with encrypted passwords leaked for non-SSO users. The breach, attributed to a fixed security vulnerability, is separate from a recent Canvas platform attack affecting 275 million users. Group GTI and Instructure have not disclosed full details of the incidents.

Carnival Corporation confirmed a data breach affecting nearly 6 million people, caused by a social engineering attack on a single user account. The breach exposed personal data including names, addresses, email addresses, phone numbers, dates of birth, and government-issued IDs. Leaked data also impacted Holland America's loyalty program, potentially affecting non-Carnival customers.

Pink, a new extortion group possibly rebranded from BlackFile, uses voice phishing and fake helpdesk calls to steal credentials and extort organizations. Palo Alto Networks' Unit 42 and Google Threat Intelligence debate whether Pink is a new threat or an evolution of UNC6671, with similar tactics to groups like Lapsus$ and Scattered Spider.

Charter Communications (Spectrum) confirmed a cybersecurity incident after ransomware group ShinyHunters listed it on a leak site. Hackers claimed to steal millions of customer records via a vishing attack, but Charter stated sensitive data like private telecom account information was not released.

Atlas Menu, a Grand Theft Auto V and Counter-Strike 2 cheat service, experienced a data breach in May exposing 64,000 email addresses, usernames, IP addresses, passwords, and internal records. An attacker leaked the database on GitHub, claiming access to all Atlas systems, while users noted this breach contained more sensitive data than prior incidents.

ShinyHunters leaked 4.9 million Charter Communications customer records, including names, email addresses, phone numbers, and physical addresses, after the company allegedly refused their extortion demands. Charter confirmed an investigation but claimed no sensitive data was exfiltrated, while the breach is part of a broader pattern of ShinyHunters targeting organizations, including a recent Carnival Corporation data theft.

The ShinyHunters extortion gang stole personal information from 4.9 million accounts after hacking U.S. telecom company Charter Communications. The breach was reported by data breach notification service Have I Been Pwned.

7-Eleven experienced a data breach exposing 185,000 unique email addresses and personal information like names, dates of birth, and physical addresses. The breach, linked to a 2026 extortion campaign by ShinyHunters, involved unauthorized access to systems storing franchisee documents, not customer purchase data.

Carnival Corporation confirmed a data breach affecting nearly 6 million customers after a social engineering attack on April 14. Hacking group ShinyHunters claimed to have stolen terabytes of data, including personal information like names, addresses, and identification numbers. Carnival is offering free credit monitoring to affected individuals and has enhanced its security measures.

Charter Communications, a U.S. telecommunications giant, confirmed a data breach following an extortion threat from the ShinyHunters group, which demanded a ransom to prevent stolen data from being leaked.

The ShinyHunters extortion gang hacked 7-Eleven's systems in April, stealing personal information of over 183,000 people, as reported by Have I Been Pwned.

7-Eleven confirmed a breach after ShinyHunters claimed it, discovering the breach on April 8 and determining that cybercriminals accessed certain systems used to store franchisee documents. The breach notification letters were sent out following an investigation. Cybercriminals gained access to sensitive information.

7-Eleven confirmed a data breach claimed by the ShinyHunters gang, which occurred last month. The breach affected the convenience store chain's systems. The ShinyHunters extortion group is responsible for the cyberattack.

The Canvas breach resulted in 3.65 terabytes of data stolen from approximately 275 million users, highlighting the need for improved security measures. The attack was carried out by ShinyHunters, who compromised 'Free-For-Teacher' accounts and escalated rapidly. This incident exposes the gap in enterprise security frameworks, which still treat SaaS platforms primarily as availability problems.

Instructure reached an agreement with data theft and extortion crew ShinyHunters after a breach of Canvas user data, but experts doubt that stolen data was deleted. The incident affects nearly 9,000 universities and K-12 schools, and around 275 million students, teachers, and staff. Experts expect further phishing attacks using leaked information.

The House Committee on Homeland Security sent a letter regarding the Canvas cyberattack, which occurred on the same day that Canvas reached an agreement with the ShinyHunters cybercriminal group. The incident has put pressure on infrastructure. The edtech company is dealing with the aftermath of the attack.

The US House Committee on Homeland Security is seeking testimony from Instructure executives regarding two cyberattacks on the Canvas platform by the ShinyHunters extortion group, which resulted in stolen student data and school disruptions. The attacks occurred during final exams and targeted the company's platform. The committee's call for testimony indicates a growing concern over cybersecurity threats in educational institutions.

The US Congress is investigating a breach of Instructure's Canvas online platform, which was hacked twice in two weeks, and the company has paid a ransom to extortion crew ShinyHunters. The breach affected up to 275 million students, teachers, and staff. Instructure's CEO Steve Daly has been summoned to explain the circumstances of the intrusions.

A hacking group named ShinyHunters claimed responsibility for the Canvas breach and threatened to leak data involving 275 million individuals if schools did not pay a ransom. The parent company of Canvas has struck a deal with the hackers to delete the stolen data. This deal aims to prevent the sensitive information from being leaked.

Instructure, the company behind Canvas, reached an agreement with hackers to secure stolen data, preventing a leak of 3.5 terabytes of student data. The agreement came after the ShinyHunters hacking group claimed responsibility for the attack and threatened to publish the data. Instructure claims no customers will be extorted as a result.

Instructure reached an agreement with ShinyHunters to stop a data leak from being leaked online after a recent breach, involving the Canvas learning management system. The agreement aims to prevent stolen data from being published. Instructure is an edtech giant.

Instructure reached a ransom agreement with ShinyHunters to stop a 3.65TB Canvas leak after a network breach. The breach threatened to leak stolen information from thousands of schools and universities. Instructure is the parent company of Canvas.

Cybercriminals are threatening to leak sensitive data from Canvas, a widely used education tech platform, after a prolonged cyberattack. The company behind Canvas, Instructure, has taken the platform offline following malicious activity. A decentralized crew of cybercriminals, ShinyHunters, is attempting to extort the company for an unknown ransom amount.