ShinyHunters 2026 activity
Extortion group. 8 reports in 6 countries: 8 confirmed, 0 claimed or disputed. Latest 28 Aug 2026.
United States · 
United Kingdom · 
Malaysia · 
Singapore · 
Canada · 
Netherlands
🎯 What sources say
- Malaysia: Claimed more than 40 GB from the University of Nottingham records system covering its Malaysia campus in June 2026. Free Malaysia Today
- Singapore: Claimed the May 2026 Canvas breach that exposed NUS, SUSS and SIM student data, and listed Aman Resorts in April. AsiaOne ransomware.live
- United Kingdom: Claimed the University of Nottingham student records breach in June 2026. BleepingComputer
- Netherlands: Breached Odido and leaked 6.5 million customer records in March 2026. NL Times
- United States: Claimed data theft from Wynn Resorts, DentaQuest and McKesson in 2026. HIPAA Journal The Record
- Canada: Claimed the Telus Digital breach and a multi-month theft of BPO and telecom data. BleepingComputer
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ✅ ConfirmedMcKessonVia a vendor | United States | 28 Aug 2026 | Health | Supply chain | ShinyHunters | Confirmed. McKesson disclosed in SEC filings that attackers used a third-party application to take data on oncology and surgical customers. Claimed. ShinyHunters claimed the attack and threatened to leak the data. | The Record✓ 7 Nov |
 ✅ ConfirmedUniversity of NottinghamVia a vendor | United Kingdom | 10 Jun 2026 | Education | Data leak | ShinyHunters | Confirmed. The university said a well-known cybercriminal group accessed a significant amount of data in its third-party student record system and reported it to the ICO. Claimed. ShinyHunters claimed over 40GB of student finance and payment files as part of an Oracle PeopleSoft campaign; Have I Been Pwned lists 454,600 affected people. | BleepingComputer✓ 7 Nov |
 ✅ ConfirmedUniversity of Nottingham MalaysiaSelangor | Malaysia | 9 Jun 2026 | Education | Data leak | ShinyHunters | Confirmed. The university said the incident on its UK-based student records system was contained, a forensic investigation was under way and affected students and alumni were told directly. Claimed. ShinyHunters claimed more than 40 GB including billing, payment and student finance records from the UK, Malaysia and China campuses. | Free Malaysia Today✓ 7 Nov |
 ✅ ConfirmedDentaQuestFull story | United States | 20 May 2026 | Health | Data leak | ShinyHunters | Confirmed. DentaQuest found unauthorized network access between 17 and 20 May 2026 and is notifying at least 15 million people. Claimed. ShinyHunters claimed 234 GB of stolen data and leaked it after talks failed. | HIPAA Journal✓ 7 Nov |
| ✅ ConfirmedNational University of Singapore, SUSS and SIM (Canvas)Via a vendor | Singapore | 8 May 2026 | Education | Supply chain | ShinyHunters | Confirmed. NUS said names, email addresses and matriculation numbers were exposed in the breach of the Instructure Canvas learning platform and that no login credentials were compromised; SUSS told students no passwords, NRIC numbers or financial data were involved. Claimed. ShinyHunters claimed the attack on Canvas. | AsiaOne · The Star✓ 7 Nov |
 ✅ ConfirmedTelus Digital | Canada | 12 Mar 2026 | Telecom | Data leak | ShinyHunters | Confirmed. Telus confirmed unauthorized access to a limited number of its systems and said operations continued. Claimed. ShinyHunters claimed close to 1 petabyte of data and a $65 million demand. | BleepingComputer✓ 7 Nov |
 ✅ ConfirmedWynn Resorts | United States | 24 Feb 2026 | Other | Data leak | ShinyHunters | Confirmed. Wynn said an unauthorized third party acquired certain employee data, after ShinyHunters listed the company on its leak site. Claimed. ShinyHunters claimed over 800,000 records including Social Security numbers. | BleepingComputer✓ 7 Nov |
 ✅ ConfirmedOdido | Netherlands | 12 Feb 2026 | Telecom | Data leak | ShinyHunters | Confirmed. Odido said a cyberattack on its customer contact system exposed data of 6.2 million customers and reported it to the Dutch Data Protection Authority. Claimed. ShinyHunters claimed the breach and published the data after Odido refused to pay. | BleepingComputer · NL Times✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology