{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T22:41:49.181Z", "tag": { "id": "shinyhunters", "label": "ShinyHunters", "isStack": false, "url": "https://pwn.watch/t/shinyhunters", "feed": "https://pwn.watch/t/shinyhunters/feed.xml" }, "counts": { "incidents": 4, "live": 0, "notFullyPatched": 0, "patched": 3 }, "incidents": [ { "slug": "canvas-instructure-shinyhunters-may", "title": "Instructure Canvas Free-for-Teacher breach (ShinyHunters)", "url": "https://pwn.watch/i/canvas-instructure-shinyhunters-may", "json": "https://pwn.watch/i/canvas-instructure-shinyhunters-may.json", "status": "closed", "severity": "high", "patchStatus": "partial", "product": "Instructure Canvas (Free-for-Teacher)", "tags": [ "instructure", "shinyhunters", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-05-01", "closedAt": "2026-05-31", "updatedAt": "2026-05-31", "summary": "In May 2026 Instructure confirmed a security incident involving Canvas Free-for-Teacher after ShinyHunters claimed theft of data tied to hundreds of millions of users. Exposed data included names, emails, student IDs and some private messages; Instructure said it had no evidence passwords or financial/government IDs were taken.", "xPost": null }, { "slug": "crunchbase-shinyhunters-jan", "title": "ShinyHunters leak Crunchbase data (~2M records)", "url": "https://pwn.watch/i/crunchbase-shinyhunters-jan", "json": "https://pwn.watch/i/crunchbase-shinyhunters-jan.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Crunchbase", "tags": [ "crunchbase", "shinyhunters", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-01-01", "closedAt": "2026-01-31", "updatedAt": "2026-01-31", "summary": "In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.", "xPost": null }, { "slug": "red-hat-consulting-gitlab-breach-october-2025", "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025", "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Red Hat Consulting self-managed GitLab", "tags": [ "devtools", "red-hat", "gitlab", "crimson-collective", "shinyhunters", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-10-01", "closedAt": "2025-10-10", "updatedAt": "2025-10-10", "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.", "xPost": null }, { "slug": "salesforce-vishing-data-theft-unc6040-2025", "title": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025", "json": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Salesforce customer instances (social engineering, not a Salesforce vulnerability)", "tags": [ "salesforce", "google", "shinyhunters", "vishing", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-06-04", "closedAt": "2025-08-31", "updatedAt": "2025-08-31", "summary": "UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).", "xPost": null } ], "posts": [], "changes": [ { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-10", "title": "FINRA alert to member firms", "body": null, "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-02", "title": "Red Hat confirms the incident", "body": null, "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-01", "title": "Crimson Collective claims the Red Hat GitLab theft", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "salesforce-vishing-data-theft-unc6040-2025", "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-08", "title": "Google confirms the breach exposed prospective Google Ads customers' contact info", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025" }, { "incident": "salesforce-vishing-data-theft-unc6040-2025", "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-06-04", "title": "Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse", "body": null, "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025" }, { "incident": "salesforce-vishing-data-theft-unc6040-2025", "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-06", "title": "Google's corporate Salesforce instance breached by UNC6040", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/", "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025" } ] }