ShinyHunters has established itself as one of the most feared cybercriminal groups of the decade, responsible for data breaches affecting more than a billion users worldwide. Behind its playful, Pokémon-inspired name lies a sophisticated criminal organisation that has transformed data theft attacks.
Since they first appeared in April 2020, the members of ShinyHunters have orchestrated some of the biggest data breaches in recent history, targeting tech giants such as Microsoft, Google and AT&T and, more recently, running a large-scale campaign against the Salesforce instances of major companies worldwide.
Last updated: August 2025
The origins of ShinyHunters: from Pokémon to cybercrime
The name “ShinyHunters” has its roots in the Pokémon video games, where “shiny hunters” are players who actively seek out rare Pokémon with alternative colours. The group’s name is thought to derive from shiny Pokémon, a mechanic in the Pokémon franchise where Pokémon have a rare chance of being encountered in an alternative, “shiny” colour scheme.
The reference is no accident: just as Pokémon hunters seek rare and valuable creatures, ShinyHunters hunts down companies’ sensitive data to resell it on the dark web. The analogy reveals the group’s methodical approach and its obsession with high-value data “trophies”.
The organisational structure of ShinyHunters
Contrary to what the name might suggest, ShinyHunters is not an individual but a group of cybercriminals. Cybersecurity experts believe several actors operate under this banner, which works as a collective brand rather than a single entity.
For cybercriminals, this brand name is pure gold. It provides instant credibility on the dark web, commanding higher prices for stolen data and giving leverage for extortion. This decentralised brand strategy makes it considerably harder for law enforcement to attribute attacks.
ShinyHunters’ tactical evolution: from reselling to extortion
Initially, ShinyHunters followed a simple business model: steal databases and resell them on hacker forums. In 2024, however, the group shifted towards extorting its victims rather than its traditional tactic of selling or publishing stolen data.
This strategic shift reflects the group’s growing sophistication and its adaptation to profit opportunities. Instead of one-off sales, it now puts direct pressure on victims to obtain larger ransoms.
The ransoms demanded
The sums demanded by ShinyHunters reach considerable levels. BleepingComputer learned that one company paid 4 bitcoins, around $400,000, to prevent its data from being leaked. In the case of AT&T, a report last July indicated that AT&T Inc. had paid $370,000 in bitcoin to ShinyHunters to stop stolen details being published.
The main victims of ShinyHunters
The record of ShinyHunters’ attacks is striking for its scale and the variety of sectors affected.
Historic attacks (2020-2023)
Tokopedia (May 2020): on 2 May 2020, Tokopedia was breached by ShinyHunters, who claimed to have data for 91 million user accounts, revealing users’ gender, location, username, full name, email address, phone number and hashed passwords.
Microsoft (May 2020): in May 2020, ShinyHunters also claimed to have stolen more than 500 GB of Microsoft source code from the company’s private GitHub account. This attack marked a turning point in its technical capabilities.
Wattpad (July 2020): in July 2020, ShinyHunters accessed the Wattpad database containing 270 million user records, one of the largest data breaches of the year.
The Snowflake campaign (2024)
2024 was a pivotal year for ShinyHunters, with its involvement in the massive attacks on Snowflake customers. The 2024 Ticketmaster data breach, which affected more than 560 million users, was significantly shaped by the role of Snowflake, the cloud provider used by Ticketmaster.
The campaign also hit Santander, Ticketmaster and Neiman Marcus, showing the group’s ability to run large-scale coordinated operations.
The current Salesforce campaign (2025)
ShinyHunters’ most recent campaign specifically targets large companies’ Salesforce instances. A wave of data breaches affecting companies such as Qantas, Allianz Life, LVMH and Adidas has been linked to the ShinyHunters extortion group, which uses voice phishing attacks to steal data from Salesforce CRM instances.
Confirmed victims include:
- Google: SMB contact data compromised
- Cisco: user profile information stolen
- Adidas: customer service tickets exposed
- LVMH (Louis Vuitton, Dior, Tiffany): regional customer contact records
- Pandora: customer profiles compromised
- Qantas: passenger data from CRM tables
ShinyHunters’ attack methods
Vishing: their current speciality
UNC6040 is a financially motivated threat cluster that gains access to victims’ networks through voice phishing social engineering. Its current technique relies on sophisticated phone calls in which attackers pose as internal IT support.
Typical attack process:
- In-depth reconnaissance: researching information about the target company
- Vishing call: a phone call posing as IT support
- Manipulation: convincing the employee to authorise a malicious application
- Installation of the modified Data Loader: a legitimate Salesforce tool turned against its users
- Mass exfiltration: exporting all accessible data
- Lateral movement: spreading to other platforms (Okta, Microsoft 365)
Exploiting GitHub repositories
ShinyHunters starts by identifying companies that use Microsoft Office 365. It then looks for companies that store exposed GitHub authorisation tokens. This approach lets it identify vulnerabilities in the software supply chain.
Anonymisation techniques
ShinyHunters uses sophisticated infrastructure to hide its activities. The infrastructure used by UNC6040 includes Mullvad VPN IP addresses and the Tor network to anonymise its access and exfiltration activities.
Links with other cybercriminal groups
Scattered Spider and The Com
The group is also thought to have links with “The Com”, a network of experienced English-speaking cybercriminals. These connections suggest collaboration between different criminal collectives to maximise the effectiveness of attacks.
According to Recorded Future intelligence, the overlapping TTPs between known Scattered Spider and ShinyHunters attacks probably indicate some crossover between the two groups.
The “extortion-as-a-service” model
Some experts theorise that ShinyHunters acts as an extortion service, extorting companies on behalf of other threat actors in exchange for a share of the revenue, similar to how ransomware-as-a-service gangs operate.
BreachForums: the criminal showcase
ShinyHunters was closely linked to the administration of BreachForums, one of the largest cybercrime forums in the world. The ShinyHunters persona teamed up with Baphomet to relaunch the second BreachForums instance (v2) in June 2023 and later launched the June 2025 instance (v4) alone.
The forum served as a marketplace for selling stolen data, hacking tools and cybercrime services, generating substantial revenue for its administrators.
Recent arrests: a heavy blow for the group
The French arrests of June 2025
On 25 June 2025, the French authorities announced that four members of the ShinyHunters cybercriminal group had been arrested in several French regions for cybercriminal activities.
The four hackers, known as ShinyHunters, Hollow, Noct and Depressed, were arrested in the Paris suburbs, in Normandy and on Réunion, a French overseas territory.
The arrest of IntelBroker
Kai West was arrested in France along with four other hackers, all suspected of being part of the notorious hacker forum BreachForums. West, operating under the alias IntelBroker, was considered one of the forum’s key administrators.
The impact on operations
These arrests are a significant blow to the ShinyHunters ecosystem, but experts remain cautious about their long-term impact. This decentralised model is a cybersecurity nightmare, turning the attribution of attacks into a game of smoke and mirrors.
The financial impact of ShinyHunters attacks
With estimates putting the average data breach this year at around $4.4 million, we can estimate that ShinyHunters has cost companies tens of millions of dollars in damage this year.
The impact goes well beyond immediate costs:
- Loss of customer trust
- Notification and regulatory compliance costs
- Legal and technical expert fees
- Impact on stock market valuation
- Costs of post-incident security reinforcement
How to protect yourself against ShinyHunters
Securing Salesforce environments
In the face of the current Salesforce campaign, organisations should:
- Drastically restrict “API Enabled” permissions
- Implement rigorous management of connected applications
- Configure trusted IP address restrictions
- Block access from commercial VPNs
Anti-vishing training
Train help desk staff to rigorously carry out positive identity verification for all employees before modifying accounts or providing security-sensitive information.
Employees must be made aware of the psychological manipulation techniques used by attackers posing as internal IT support.
Advanced technical controls
- Stronger multi-factor authentication (no SMS or email)
- Continuous monitoring of API access
- Anomaly detection in data export patterns
- Network segmentation and the principle of least privilege
The future of ShinyHunters
Despite the recent arrests, as some analysts note, ShinyHunters is not so much an evolving, growing threat actor in the conventional sense. It looks more like a brand name, Donald Trump/MAGA-style, borrowed by several threat actors with their own methods.
This decentralised “brand” nature suggests that even if some key members are neutralised, others can keep operating under the banner. The challenge for law enforcement remains to dismantle the whole ecosystem rather than settling for one-off arrests.
Recent tactical changes
According to the 5 August update, UNC6040 now uses Mullvad VPN and Tor IP addresses and custom Python scripts instead of the modified Data Loader app. This continuous adaptation shows the group’s ability to evolve in response to security countermeasures.
ShinyHunters: a symbol of how cybercrime is changing
ShinyHunters perfectly represents the evolution of the modern cybercriminal landscape: from hierarchically organised groups to decentralised collectives operating like brands. Its ability to adapt, innovate and collaborate with other groups makes it one of the most formidable adversaries companies face today.
The fight against ShinyHunters illustrates the complex challenges of modern cybersecurity, where technology alone is no longer enough. Effective protection requires a holistic approach combining advanced technical controls, continuous human training and constant organisational vigilance against adversaries that never stop evolving.
ShinyHunters: frequently asked questions
ShinyHunters is a cybercriminal group formed in 2020, whose name is inspired by the shiny Pokémon hunters of the video games. It specialises in mass data theft and corporate extortion.
Its most notable victims include Microsoft, Google, AT&T, Tokopedia, Wattpad, Ticketmaster, Santander and, recently, many companies using Salesforce such as Adidas, LVMH and Qantas.
It mainly uses vishing (voice phishing) techniques to pose as IT support and convince employees to authorise malicious applications, notably on Salesforce.
In June 2025, several suspected members were arrested in France, but the group operates as a decentralised brand, allowing other actors to keep operating under the name.
Experts estimate that ShinyHunters has caused tens of millions of dollars in damage. Some companies have paid ransoms of up to $400,000 to prevent their data from being published.
The main measures include anti-vishing training for employees, restricting API permissions, stronger multi-factor authentication and continuous monitoring of access to sensitive systems.
Leave a Reply