Home > List all groups > ShinyHunters

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Other threat group: ShinyHunters

NamesShinyHunters (self given)
MotivationFinancial gain
First seen2020
Description(ZeroFOX) ShinyHunters is taking a page out of the book of Gnosticplayers, the breach data broker who in 2018-2019 pilfered billions of records from dozens of companies and sold them online. Due to the verification of the Tokopedia breach by multiple researchers and the company itself, ZeroFOX Alpha Team has HIGH confidence that these new breaches are legitimate, and will most likely be available on other breach marketplaces at lower prices in the near future. It is likely that this actor will continue to breach companies and post their content for sale. These tactics proved both successful and profitable for gnosticplayers, and it is likely they will continue to appeal to other breach brokers for these reasons.
Tools used
Operations performedJan 2020Hacker leaks 40 million user records from popular Wishbone app
Jan 202025 million user records leak online from popular math app Mathway
Mar 2020Hacker leaks 15 million records from Tokopedia, Indonesia's largest online store
Mar 2020A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer has learned.
Mar 2020Hackers sell stolen user data from HomeChef, ChatBooks, and Chronicle
May 2020Online learning platform Unacademy has suffered a data breach after a hacker gained access to their database and started selling the account information for close to 22 million users.
Jun 2020Havenly discloses data breach after 1.3M accounts leaked online
Jul 2020An allegedly stolen Wattpad database containing 270 million records were being sold in private sales for over $100,000. Now it is being offered for free on hacker forums.
Jul 2020Tech unicorn Dave admits to security breach impacting 7.5 million users
Jul discloses data breach after 22M user records leaked online
Nov 2020ShinyHunters hacker leaks 5.22GB worth of database

Last change to this card: 05 January 2021

Download this actor card in PDF or JSON format

Previous: Shadow Brokers
Next: Shark Spider

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
PGP Download PGP key