Shiny Hunters hackers try to sell a host of user records from breaches

guest · Aug 19, 2020

Data has been added to Have I Been Pwned:

Catho – 1,173,012 breached accounts

Catho
In approximately March 2020, the Brazilian recruitment website Catho was compromised and subsequently appeared alongside 20 other breached websites listed for sale on a dark web marketplace. The breach included almost 11 million records with 1.2 million unique email addresses. Names, usernames and plain text passwords were also exposed. The data was provided to HIBP by breachbase.pw.

Breach date: 1 March 2020
Date added to HIBP: 18 August 2020
Compromised accounts: 1,173,012
Compromised data: Email addresses, Names, Passwords, Usernames
Permalink
Click to expand...

guest · Oct 31, 2020

Star Tribune data leaked for free on dark web
October 29, 2020
https://cybernews.com/security/star-tribune-data-leaked-free-dark-web/

Cybercriminals leaked 1 million Star Tribune users’ data on a popular Russian hacking forum. The data leak follows a reported hack in early May 2020, in which the Star Tribune, along with 10 other companies, had their systems breached by a hacking group known as Shiny Hunters.

Along with Star Tribune user data, the cybercriminal is also leaking Minted.com user data. Minted.com is a design marketplace for independent artists.
The Star Tribune data being leaked
The data was being made available in a 900-megabyte SQL file.
The fact that the Star Tribune was hacked in the first place points to a fault in their online systems.
Click to expand...

Minted.com data leaked
The same leaker also gave away hacked data from Minted.com, a marketplace for independent artists. This forum post appears to show that the data is from a February 2020 hack. The hack by the Shiny Hunters group was reported at the end of May 2020, where it reportedly sold 5 million users’ data.
Click to expand...

guest · Nov 5, 2020

Data has been added to Have I Been Pwned:

StarTribune – 2,192,857 breached accounts

StarTribune
In October 2019, the Minnesota-based news service StarTribune suffered a data breach which was subsequently sold on the dark web. The breach exposed over 2 million unique email addresses alongside names, usernames, physical addresses, dates of birth, genders and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

Breach date: 10 October 2019
Date added to HIBP: 30 October 2020
Compromised accounts: 2,192,857
Compromised data: Dates of birth, Email addresses, Genders, Names, Passwords, Physical addresses, Usernames
Permalink
Click to expand...

Minted – 4,418,182 breached accounts

Minted
In May 2020, the online marketplace for independent artists Minted suffered a data breach that exposed 4.4M unique customer records subsequently sold on a dark web marketplace. Exposed data also included names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

Breach date: 6 May 2020
Date added to HIBP: 3 November 2020
Compromised accounts: 4,418,182
Compromised data: Email addresses, Names, Passwords, Phone numbers, Physical addresses
Permalink
Click to expand...

guest · Nov 5, 2020

ShinyHunters hacker leaks 5.22GB worth of Mashable.com database
November 5, 2020
https://www.hackread.com/shinyhunters-hacker-leaks-mashable-database/

Another day, another data breach. This time, the infamous hacker going by the online handle of ShinyHunters has leaked a database belonging to Mashable.com, a global media, and entertainment company.
The 5.22GB worth of database was leaked earlier today on a prominent hacker forum. It can be confirmed that the database is now available on several other forums including Russian-speaking ones.

However, a sigh of relief for Mashable is that the database does not contain any password or financial details since the company runs an online shop on the same domain. The hacker, ShinyHinters, has also stated in their post on hacker forum that the “it (database) does not contain any password.
We have informed Mashable about the breach and this article will be updated in case the media giant gets back to us with a statement.
Click to expand...

guest · Nov 8, 2020

mood said: ↑

ShinyHunters hacker leaks 5.22GB worth of Mashable.com database November 5, 2020
Click to expand...

Mashable
Notice of data security incident
https://mashable.com/article/mashable-data-security-issue/

This past Wednesday evening, November 4th, we learned that a hacker known for targeting websites and apps had posted a copy of a Mashable database to the internet. Based on our review, the database related to a feature that, in the past, had allowed readers to use their social media account sign-in (such as Facebook or Twitter) to make sharing content from Mashable easier.

As soon as we learned of the incident we began investigating, and we have temporarily disabled Mashable access to all affected accounts as a precaution.
It is important to note that Mashable does not require, nor store any financial data for its registered users. Additionally, based on our investigation to date, we have no reason to believe that any user password data was accessed.
Click to expand...

Protecting our users’ data is one of our highest priorities. We are working hard to investigate the issue and prevent it from happening again.
Click to expand...

guest · Nov 13, 2020

Data has been added to Have I Been Pwned:

Mashable – 1,414,677 breached accounts

Mashable
In approximately mid-2020, Mashable suffered a data breach that subsequently turned up publicly in November 2020. The data included 1.4 million unique email addresses along with names, genders, expired auth tokens, physical locations, links to social media profiles and days and months of birth. The data was provided to HIBP by dehashed.com.

Breach date: 1 June 2020
Date added to HIBP: 10 November 2020
Compromised accounts: 1,414,677
Compromised data: Auth tokens, Email addresses, Genders, Geographic locations, IP addresses, Names, Partial dates of birth, Social media profiles
Permalink
Click to expand...

Home Chef – 8,815,692 breached accounts

Home Chef
In early 2020, the food delivery service Home Chef suffered a data breach which was subsequently sold online. The breach exposed the personal information of almost 9 million customers including names, IP addresses, post codes, the last 4 digits of credit card numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

Breach date: 10 February 2020
Date added to HIBP: 13 November 2020
Compromised accounts: 8,815,692
Compromised data: Email addresses, Geographic locations, IP addresses, Names, Partial credit card data, Passwords, Phone numbers
Permalink
Click to expand...

guest · Nov 14, 2020

Hacker shares 3.2 million Pluto TV accounts for free on forum
November 14, 2020
https://www.bleepingcomputer.com/ne...-million-pluto-tv-accounts-for-free-on-forum/

A hacker is sharing what they state are 3.2 million Pluto TV user records that were stolen during a data breach.

Pluto TV is an Internet television service that lets you stream free TV shows with advertisements. The service has over 28 million members, and its mobile apps have been installed over 10 million times.
Pluto TV database leaked on a hacker forum
On Wednesday, a threat actor shared what they say is a Pluto TV user database containing 3.2 million user records. This data breach is once again attributed to ShinyHunters.
The samples of the database seen by BleepingComputer contains a member's display name, email address, bcrypt hashed password, birthday, device platform, and IP address.
Click to expand...

In a statement to BleepingComputer, though, Pluto TV has not confirmed if the data breach occurred, and only that they are investigating.

"While at this time, we cannot verify the veracity of this claim, any attempt to compromise the security of our users, platform, or details are treated with the utmost priority. We are investigating the matter," Pluto TV told BleepingComputer.
Click to expand...

guest · Dec 5, 2020

mood said: ↑

Hacker shares 3.2 million Pluto TV accounts for free on forum November 14, 2020
Click to expand...

3 Million Pluto TV Users' Data Was Hacked, But the Company Isn't Telling Them
December 4, 2020
https://www.vice.com/en/article/88a8ma/pluto-tv-hacked-data-breach

Low-level hackers are trading a database of user information stolen from Pluto TV, a popular American internet television service. But Pluto TV has decided not to proactively inform users of the breach.

The move is somewhat unusual in a space where companies increasingly inform their customers of data breaches, even regarding breaches that do not include passwords themselves, but other information such as email addresses.

"I have received password reset requests about it," one Pluto TV user, who has not received any communication from the company despite contacting Pluto TV, told Motherboard.
Click to expand...

The data breach itself impacts an alleged 3.2 million Pluto TV accounts, Bleeping Computer reported in mid-November.

But on Thursday, Pluto TV told Motherboard it was only communicating about the breach with users who have reached out to the company.

"While this matter remains under investigation, no new or additional information has been presented that differs from what’s been reported to-date. As we continue to investigate this matter, we are communicating with users who have reached out to us directly to address any questions or concerns," Pluto TV's statement read.
Click to expand...

guest · Dec 6, 2020

Data has been added to Have I Been Pwned:

Pluto TV – 3,225,080 breached accounts

Pluto TV
In October 2018, the internet television service Pluto TV suffered a data breach which was then shared extensively in hacking communities. Pluto TV "decided not to proactively inform users of the breach" which contained 3.2M unique email and IP addresses, names, usernames, genders, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

Breach date: 12 October 2018
Date added to HIBP: 5 December 2020
Compromised accounts: 3,225,080
Compromised data: Dates of birth, Device information, Email addresses, Genders, IP addresses, Names, Passwords, Social media profiles, Usernames
Permalink
Click to expand...

guest · Jan 20, 2021

Hacker posts 1.4 million Pixlr user records for free on forum
January 20, 2021
https://www.bleepingcomputer.com/ne...million-pixlr-user-records-for-free-on-forum/

A hacker has leaked 1.4 million Pixlr user records containing information that could be used to perform targeted phishing and credential stuffing attacks.

Pixlr is a very popular and free online photo editing application with many of the same features found in a professional desktop photo editor like Photoshop. While Pixlr offers basic editing tools for free, the site also provides premium memberships that include more advanced tools, stock photos, and other features.
Click to expand...

Over the weekend, a threat actor known as ShinyHunters shared a database for free on a hacker forum that he claims was stolen from Pixlr while he breached the 123rf stock photo site. Pixlr and 123rf are both owned by the same company, Inmagine.
The alleged Pixlr database posted by ShinyHunters contains 1,435,235,357 user records consisting of email addresses, login names, SHA-512 hashed passwords, a user's country, whether they signed up for the newsletter, and other internal information.
Click to expand...

guest · May 7, 2021

ShinyHunters leak database of Indian wedding portal WedMeGood
The leaked WedMeGood database contains 41.5 GB worth of data
May 6, 2021
https://www.hackread.com/shinyhunters-leak-india-wedmegood-database/

ShinyHunters, the notorious hacker known for leaking databases of firms like Animal Jam, Mashable, Upstox, and 123RF, etc., is back with yet another high-profile data breach.

Lately, the hacker has been focusing on leaking databases of Indian entities. Although unconfirmed; it is believed that the hacker’s extortion attempts didn’t yield desirable results, which is why the hacker leaks the stolen data.
This time around, ShinyHunters has dumped a database belonging to WedMeGood, a popular Indian wedding planning platform that looks after every aspect of the wedding, from finding venues to photographers and arranging for wedding outfits.
Click to expand...

It is worth noting that apparently, WedMeGood suffered a data breach back in October 2020 when a threat actor published a list of several compromised sites and offered their database for price.
Click to expand...

guest · Aug 20, 2021

AT&T breach? ShinyHunters selling AT&T database with 70 million SSN
The alleged AT&T database is being sold for starting price of $200,000
August 20, 2021
https://www.hackread.com/att-breach-shinyhunters-database-selling-70-million-ssn/

ShinyHunters, the notorious hacker is claiming to have access to the AT&T database containing personal and sensitive records of more than 70 million customers.
For your information, AT&T Inc. is the largest provider of mobile telephone services in the U.S. and also the world’s largest telecommunications company.

In a post published on the infamous hacker forum and marketplace Raid Forums, ShinyHunters is offering the database for starting price of $200,000.
Click to expand...

Although AT&T is yet to comment on the breach if the data is legitimate it will be a disaster for the company and its customers.
It is worth noting that as of 2019, AT&T had a subscriber base of approximately 77 million post-paid and 18 million prepaid customers in the United States.

Hackread.com has contacted AT&T therefore expect an update.
Click to expand...

Update:
In a statement to Hackread.com, AT&T has denied being breached.

“Based on our investigation today, the information that appeared in an internet chat room does not appear to have come from our systems,” AT&T maintains.
Click to expand...

guest · Aug 23, 2021

Researchers Detail Modus Operandi of ShinyHunters Cyber Crime Group
August 23, 2021
https://thehackernews.com/2021/08/researchers-detail-modus-operandi-of.html

ShinyHunters, a notorious cybercriminal underground group that's been on a data breach spree since last year, has been observed searching companies' GitHub repository source code for vulnerabilities that can be abused to stage larger scale attacks, an analysis of the hackers' modus operandi has revealed.

"Primarily operating on Raid Forums, the collective's moniker and motivation can partly be derived from their avatar on social media and other forums: a shiny Umbreon Pokémon," Intel 471 researchers said in a report shared with The Hacker News. "As Pokémon players hunt and collect "shiny" characters in the game, ShinyHunters collects and resells user data."
An assessment by Risk Based Security found that the threat actor has exposed a total of more than 1.12 million unique email addresses belonging to S&P 100 organizations, education, government and military entities as of late 2020.
Click to expand...

ShinyHunters has a checkered history of compromising websites and developer repositories to steal credentials or API keys to a company's cloud services, which are subsequently abused to gain access to databases and gather sensitive information to be resold for profit or published for free on hacker forums.

"ShinyHunters may not have as much notoriety as the ransomware groups that are currently causing havoc for enterprises all over the world. However, tracking actors like this are crucial to preventing your enterprise from being hit with such an attack," the researchers said.
Click to expand...

Intel 471: Here's how to guard your enterprise against ShinyHunters

Intel 471 has also observed the group follow TTPs in the MDCoA column, but then leverage the credentials in secondary or tertiary attacks. Additionally, the group will also search a company's GitHub repository source code for vulnerabilities within the code itself. These vulnerabilities are used in further, more complex, third-party or supply chain attacks.

The information ShinyHunters gathers is often turned around and sold on the same underground marketplaces where ransomware actors use it to launch their own attacks. If enterprises can move to detect activity like ShinyHunters, they in turn can stop ransomware attacks before they are ever launched.
Click to expand...

guest · Jul 31, 2022

Alleged ShinyHunters Hacker Group Member Arrested
July 31, 2022

A French student has been detained in Morocco on Interpol Red Notice after the US FBI (Federal Bureau of Investigation) accused him of being “one of the important members” of the infamous ShinyHunters group and hacking into hundreds of American organizations.

Sebastian Raoult (Le Français Sébastien Raoult), aka Sezyo, was arrested on June 1st 2022 from the Rabat international airport. The suspect wanted to board a flight to Brussels, Belgium. According to the FBI, the suspect is allegedly part of a group of hackers called ShinyHunters.
Click to expand...

The ShinyHunters Connection
According to L’Obs, the detained Frenchman is a member of the notorious ShinyHunters hacking collective. It is worth noting that ShinyHunters is known for targeting high-profile companies, stealing their databases, and selling them on the dark web and clearnet marketplaces.

In January 2021, Hackread.com exclusively reported on one of the ShinyHunters’ massive hacks in which the hackers were offering databases of 26 organizations impacting 368 million users.
Click to expand...

guest · Jan 26, 2023

ShinyHunters suspect extradited to United States from Morocco, could face 116 years in jail if convicted
By Graham Cluley @gcluley - January 26, 2023

A 22-year-old suspected of being "Seyzo", a member of the ShinyHunters cybercrime gang, has been extradited from Morocco to the United States, where - if convicted - he could face up to 116 years in prison.
Click to expand...

Sebastien Raoult, a French national, was arrested at Rabat international airport in Morocco on May 31 2022, while trying to take a flight to Brussels.

Law enforcement in Morocco detained former computer student Raoult at the request of US authorities, who believe he is a member of the ShinyHunters cybercriminal group, that has been involved in a series of high profile hacks.
Click to expand...

The Moroccon Prime Minister signed off Raoult's extradition, and the young Frenchman has been taken to the United States, under the watchful eye of FBI agents. He landed in New York's JFK airport around midnight.
Click to expand...

Log in or Sign up

Shiny Hunters hackers try to sell a host of user records from breaches

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Shiny Hunters hackers try to sell a host of user records from breaches

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches