ShinyHunters: Data-Theft Extortion From Cloud Platforms

ShinyHunters is a financially motivated data-theft and extortion group active since 2020, behind high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool. Its leak site had listed 163 victims by late September 2026, most in the US and led by technology, retail, financial services and education (ransomware.live). French authorities arrested four alleged members in August 2025, but the activity has continued.

The group's hallmark is going after data where it now lives: cloud data warehouses and SaaS platforms. Documented campaigns have used stolen passwords for cloud accounts that had no multi-factor authentication, and voice-phishing calls that talk staff into approving a malicious connected app on the company's CRM — handing over customer records without any malware on a company computer. In 2025 the group also announced its own ransomware-as-a-service offering, so encryption may feature in future attacks.

When data is stolen from a cloud platform there is usually nothing to restore — the systems still work. The work is establishing scope: which accounts and API tokens were used, what was queried or exported, and over what period, taken from the platform's audit logs before they roll over.

Revoke connected apps and tokens you do not recognise, enforce multi-factor authentication on every cloud account, and treat an extortion email as a question of scope first, not of payment.