Search — “ShinyHunters”

Binance denied a forum claim by an actor using the ShinyHunters handle to sell records of 335 million users for $900,000. Binance spokesperson said it found no evidence that its systems, KYC data, credentials, wallet keys, or infrastructure were compromised, and called the listing likely a scam, noting similar listings often involved infostealer data from users' own devices. No confirmed compromise is reported; hunters should focus on customer phishing and infostealer exposure rather than a Binance intrusion.

Harvard University's Alumni Affairs and Development systems were breached in November 2025, with the university discovering the intrusion on November 18, 2025. Have I Been Pwned analyzed a leaked archive and reports 851k unique email addresses tied to alumni, donors, parents, and some faculty, staff and students, with Harvard stating no SSNs, passwords, or payment card data were stored in the breached systems. The ShinyHunters extortion gang claimed the breach and leaked a 1.1GB archive after Harvard refused to pay, and the source gives no technical intrusion details for defenders to hunt.

Abrigo took its Sageworks risk-management application offline on October 30 after detecting irregular activity in its environment, and has since restored most functionality except borrower-facing features. The company has not disclosed the nature of the incident, and BleepingComputer reports it is unclear whether the outage stems from a breach or a technical issue. Earlier in the year, a self-described ShinyHunters-affiliated actor claimed theft of Salesforce records, which has not been confirmed, and some researchers advised rotating Sageworks API keys.

Harvard's Alumni Affairs and Development systems were breached in November 2025, with the university discovering the intrusion on November 18, 2025. Have I Been Pwned reports the leaked data covers about 851,000 unique email addresses along with names, phone numbers, addresses, and donation details, while Harvard says no SSNs, passwords, or payment card data were stored there. The ShinyHunters extortion group claimed the breach and leaked a 1.1GB archive after Harvard refused to pay; the sources contain no technical detection details or attack behaviors.

ZDI says CVE-2026-35273 in PeopleSoft PeopleTools 8.61/8.62 chains an SSRF in the Integration Gateway (PSIGW) with PSEMHUB's default trust of 127.0.0.1 in allowedhosts.properties. From there an attacker writes a web shell through a PSEMHUB log-write command, or drops a malicious XML file that Java XMLDecoder runs when the service restarts. Mandiant/GTIG attribute zero-day exploitation (May 27–June 9) and a larger September wave to ShinyHunters (UNC6240), including a WAF bypass that requests /%50SEMHUB/. Hunt for encoded PSEMHUB paths, new JSP/web files in PeopleSoft app directories, unexpected XML in PSEMHUB, and child processes spawned by the PeopleSoft service account.