SHINYHUNTERS

ShinyHunters is a prolific financially motivated threat actor group that rose to prominence in 2020 through a string of high-profile data breaches targeting major technology companies and their cloud storage infrastructure. The group name is a reference to the Pokémon gaming community term for rare, differently-coloured variants of Pokémon.

ShinyHunters became notorious for breaching and selling enormous databases on dark web marketplaces. Their 2020 campaign alone yielded data from over 70 companies including Tokopedia (91 million user records), Wishbone (40 million records), Mathway, Dave, and numerous others. The group monetised these breaches by selling the stolen data directly on hacking forums and dark web marketplaces, pioneering what became a standard business model for data theft groups.

The group's most impactful operation was the 2024 breach of Snowflake customer data, in which ShinyHunters exploited credentials obtained through infostealer malware infections to access cloud data warehouses for hundreds of major companies. The breach exploited the absence of mandatory multi-factor authentication in Snowflake customer accounts rather than vulnerabilities in Snowflake's own infrastructure.

Law enforcement operations have identified and prosecuted several ShinyHunters members, including a French national arrested in Morocco and extradited to the United States, where he was sentenced to three years in prison. Despite these actions, ShinyHunters continues to operate, reflecting the resilient, distributed nature of modern cybercriminal group structures.