Privacy UnpackedRansomware gang
Shinyhunters
Claims on its leak site since 3 October 2025, number 17 of all gangs in the last 12 months
- Claims, 12 months
- 119
- Last 30 days
- 1
- All claims
- 164
- Last claim
- 30 September 2026
Where its claimed victims are
Sectors
Claims matched to an official notice
13 organisations Shinyhunters claimed also filed a breach notice with a regulator, 11 of them after the claim (a median of 36 days later). Matched by name: the notice does not say who the attacker was.
- Novocure Inc.
Claimed 22 August 2026 · notice filed with the US Department of Health and Human Services 9 September 2026 - Cushman & Wakefield
Claimed 3 May 2026 · notice filed with the California Attorney General 7 August 2026 - DentaQuest LLC
Claimed 23 May 2026 · notice filed with the California Attorney General 16 July 2026 - Ernst & Young LLP
Claimed 27 July 2026 · notice filed with the California Attorney General 15 July 2026 - Towerpoint Wealth, LLC
Claimed 30 April 2026 · notice filed with the California Attorney General 5 June 2026 - Carnival Corporation
Claimed 19 April 2026 · notice filed with the California Attorney General 27 May 2026 - 7-Eleven, Inc.
Claimed 19 April 2026 · notice filed with the Washington Attorney General 15 May 2026 - Marcus & Millichap, Inc.
Claimed 12 April 2026 · notice filed with the Washington Attorney General 14 May 2026 - Ameriprise Financial, Inc.
Claimed 22 March 2026 · notice filed with the California Attorney General 17 April 2026 - Mercer Advisors Inc.
Claimed 24 February 2026 · notice filed with the California Attorney General 31 March 2026 - Betterment LLC
Claimed 23 January 2026 · notice filed with the Washington Attorney General 27 March 2026 - Figure Technology Solutions, Inc. (Figure Lending Corp, Figure Lending LLC, Figure Markets Credit LLC, Figure Payments Corporation)
Claimed 24 February 2026 · notice filed with the Washington Attorney General 23 February 2026 - Albertsons Companies, Inc. (Safeway, Haggen)
Claimed 11 October 2025 · notice filed with the Washington Attorney General 18 December 2025
What a claim is, and is not
A claim is a ransomware gang naming an organisation on its leak site, usually to pressure it into paying. It is the gang’s word: some claims are false, recycled from older breaches or exaggerated, and a claim says nothing about whose personal data, if any, was taken. That is why we count claims but do not list the organisations, and why a breach goes on the tracker as confirmed only when the organisation or a regulator says so.
How this is counted
Claims as collected from the gangs’ leak sites by ransomware.live, which says itself that they are unverified. We read its list every day and keep only counts: by month, by the victim’s country and by sector (as ransomware.live classifies them). Matches with official notices are by the organisation’s name, from 30 days before the claim to a year after it, against California’s and Washington’s full breach registers and every official notice on the tracker. A match is not a confirmation rate: those registers only see breaches of their own residents, and names are written differently. We never link to or visit leak sites.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.