Skip to content
Start with Identity
Join free
Threat actor · Extortion group · MITRE ATT&CK G1057

ShinyHunters identity breaches

ShinyHunters is a financially motivated cybercriminal collective that MITRE ATT&CK tracks as G1057 and describes as active since at least 2019, selling or extorting with stolen credentials and personal data. MITRE lists UNC6240 and Bling Libra as associated names and ties the group to The Com, a community whose members have included Scattered Spider and LAPSUS$. Google Threat Intelligence tracks a voice phishing cluster, UNC6040, whose operators posed as IT support and talked employees into authorizing a modified Salesforce Data Loader app, then exported CRM data. Google tracks the later extortion as UNC6240 and says that actor claimed affiliation with ShinyHunters, likely to increase pressure on victims. Several records here carry the ShinyHunters name only as the attacker's claim. MITRE also records theft of OAuth tokens and application access keys to reach cloud environments.

Also tracked as
UNC6040, UNC6240, Bling Libra
Origin (as attributed)
Financially motivated cybercriminal collective (MITRE ATT&CK); no state attribution
MITRE ATT&CK
G1057
Profile verified
Nov 5, 2026
5
incidents in the database, disclosed 2024-2026
1 / 0
MFA bypassed / not enforced (4 not applicable or undisclosed)
20%
began with stolen credentials
3 / 2
human / non-human identity abused

Incidents attributed to ShinyHunters

Records whose sources attribute the intrusion to this group or one of its tracked names, newest disclosure first. Each record links its primary sources.

Browse the full database

Identity techniques used

Identity controls that failed

How to defend against ShinyHunters

One control per initial access vector seen in this group's records, most frequent first. The identity lesson on each incident page gives the case-specific detail.

  1. Stolen credentials (1 of 5): Assume passwords leak: enforce phishing-resistant MFA on every account, watch for infostealer exposure of employee credentials, and revoke sessions when a credential is reported stolen. See Infostealer credential harvesting and Infostealer.
  2. Credential phishing (1 of 5): Replace phishable factors (SMS, voice, OTP codes) with phishing-resistant MFA so a captured password and code cannot be replayed. See Phishing-resistant MFA, Passkeys and OTP relay.
  3. OAuth token abuse (1 of 5): Inventory third-party OAuth integrations, scope their tokens narrowly, restrict where they can be used from, and revoke refresh tokens when a vendor is breached. See Refresh token abuse, Refresh token and Non-human identity.
  4. Consent phishing (1 of 5): Block users from authorizing unreviewed apps: require admin approval for new connected apps and OAuth consent, and restrict who can install data export tools. See OAuth consent phishing and Consent phishing.
  5. Identity infrastructure vulnerability (1 of 5): Patch identity infrastructure first. Token issuers must protect signing keys, rotate them, and validate issuer, audience and key scope on every token they accept. See JWKS and PKI.

Sources

  1. ShinyHunters, Group G1057
  2. The Cost of a Call: From Voice Phishing to Data Extortion (Google Threat Intelligence Group, 2025-06-04)

Profile verified Nov 5, 2026 against the sources above. Incident attributions come from each record's own sources. Corrections: contact us.

Frequently asked questions

Which breaches has ShinyHunters been linked to?
The Identity Breach Database attributes 5 identity breaches disclosed 2024-2026 to ShinyHunters: McKesson data taken from third-party applications through compromised employee accounts (2026), RingCentral customer data stolen after a social engineering attack (2026), Gainsight-published Salesforce app tokens abused against customer instances (2025), UNC6040 voice phishing campaign against Salesforce customers (2025) and Authy phone numbers enumerated through an unauthenticated endpoint (2024). Attribution follows each record's sources; where the actor name is only claimed, the record says so.
How does ShinyHunters get initial access?
Across its 5 records, the initial access vectors were stolen credentials (1), credential phishing (1), oauth token abuse (1), consent phishing (1) and identity infrastructure vulnerability (1). The identity control that failed most often was authentication (3 of 5).
Did MFA stop ShinyHunters?
In 1 of 5 incidents MFA was present and bypassed, and in 0 it was not enforced on the abused account. In the remaining 4, MFA was not applicable (no interactive login, such as a stolen key or token) or its status was not disclosed. 2 of the incidents abused a non-human identity, where user MFA does not apply.

Cite this page

SWI Community Team. (2026). ShinyHunters identity breaches. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/actors/shinyhunters/

Part of the Identity Breach Database, free to reuse under CC BY 4.0. See all threat actors.