ShinyHunters

ShinyHunters is a data-theft and extortion group with a long track record of large-scale credential and database breaches before dropping out of Bitdefender's ransomware top ten in June 2026 following law-enforcement visibility. The group gained significant public attention through a series of high-profile breaches including Tokopedia, Mathway, and several cloud-storage providers, typically exfiltrating databases and selling them on criminal marketplaces.

ShinyHunters does not follow a traditional ransomware-only model: its primary technique is data exfiltration and direct sale or extortion, with encryption used selectively. Members have faced prosecution in multiple jurisdictions; in 2022 a French national connected to the group was arrested and subsequently extradited to the United States, where charges related to computer fraud were pursued. The June 2026 ranking drop is consistent with that enforcement pressure compounding over time.

The group's significance for defenders extends beyond its own operations: ShinyHunters popularised the exfiltrate-then-extort approach that separates data theft from encryption, a model that has since been adopted by several subsequent crews. Its periodic resurgences after law-enforcement actions illustrate why ranking drops alone are not sufficient indicators of a group's permanent dissolution.