Actor Profile

ShinyHunters is a financially motivated extortion group known for large-scale data theft and public leak operations. The group operates by exfiltrating sensitive data from compromised organizations, demanding ransom payments, and publishing stolen records on dark web leak sites when victims refuse to negotiate. ShinyHunters has demonstrated capability to compromise cloud-based data platforms and third-party integration providers, targeting organizations across multiple sectors to maximize financial gain through extortion.

TTPs (Tactics, Techniques, Procedures)

ShinyHunters compromised Carhartt's Databricks analytics platform to exfiltrate over 50GB of customer and employee data. The group's operational pattern includes initial access to cloud data platforms (likely T1078 - Valid Accounts), data exfiltration from cloud storage (T1530 - Data from Cloud Storage), and extortion tactics (T1657 - Financial Theft). The group conducts reconnaissance of target data repositories, stages large-scale data theft operations, and leverages public disclosure on dark web leak sites as pressure tactics when ransom demands are not met. Historical campaigns show exploitation of third-party platforms including Snowflake instances, Salesforce integrations, and Oracle PeopleSoft zero-day vulnerabilities for initial access.

Targets & Patterns

ShinyHunters targets organizations with large customer databases and valuable personally identifiable information (PII) across diverse sectors. In this incident, the group targeted Carhartt, a major retail apparel company, compromising 12.9 million customer accounts including email addresses, names, phone numbers, and physical addresses, plus over 15,000 employee records. The group's target selection prioritizes organizations using cloud-based data platforms (Databricks, Snowflake, Salesforce) that aggregate large volumes of sensitive data. Historical targeting includes technology companies (Google, Cisco), entertainment platforms (PornHub, Vimeo, Rockstar Games), dating services (Match Group), education providers (McGraw Hill, Udemy), retail chains (7-Eleven), healthcare entities (Medtronic), and government organizations (European Commission). The pattern suggests opportunistic targeting based on platform vulnerabilities and data value rather than sector-specific focus.

Historical Context

ShinyHunters has conducted an aggressive campaign of data breaches over the past year, demonstrating escalating scale and sophistication. The group has been linked to breaches at over a dozen Snowflake customers and multiple third-party integration providers. They claimed breaches at hundreds of Salesforce customers through Aura and Salesloft Drift campaigns, allegedly stealing over 1.5 billion records. Most recently, ShinyHunters exploited an Oracle PeopleSoft zero-day vulnerability to breach more than 100 organizations. The Carhartt incident follows this established pattern: compromise of cloud data platforms, large-scale data exfiltration (50GB+), specific ransom demands ($3.3 million in this case), and public data dumps on dark web leak sites when negotiations fail. The group's consistent use of leak sites as leverage demonstrates a refined extortion methodology.

Defensive Recommendations

  • Implement robust access controls and multi-factor authentication for cloud data platforms (Databricks, Snowflake, Salesforce) to prevent credential-based compromise (mitigates T1078 - Valid Accounts)
  • Deploy cloud access security brokers (CASB) and data loss prevention (DLP) solutions to detect and block large-scale data exfiltration from cloud storage repositories (mitigates T1530 - Data from Cloud Storage)
  • Conduct regular security assessments of third-party cloud platform integrations and ensure vendor security configurations follow least-privilege principles
  • Monitor for anomalous data access patterns including bulk downloads, unusual query volumes, or access to sensitive data repositories outside normal business hours
  • Maintain offline, immutable backups of critical data to support recovery operations and reduce susceptibility to extortion demands following data theft incidents