A simple and convincing phone call from someone posing as IT support can open the door to a huge data breach. Did you know that more than 90% of successful cyber-attacks start with a phishing email [3]. That is social engineering, which is bypassing technical security systems by exploiting human behavior. ShinyHunters’ attacks show how criminals use social engineering to steal corporate information and demand payment. The FBI describes ShinyHunters as a cybercriminal group specializing in large-scale data breaches and extortion [1].
ShinyHunters starts from 2020 all the way to present. According to the U.S. Department of Justice, ShinyHunters advertised stolen data from more than 60 companies between April 2020 and July 2021 [2]. They stole hundreds of millions of customer records and caused estimated losses of more than $6 million to victim companies [2]. In January 2024, Sebastien Raoult, a 22 year old French citizen, was sentenced for 3 years in prison and more than $5 million in restitution [2]. Despite that, ShinyHunters is still active with the most recent Oracle data breach in June 2026 [5].
Anyway, investigations show how these operations exploit trust. In January 2026, Mandiant documented attackers impersonating IT staff to call employees and get them to sign in the fake company login pages [4]. These pages capture passwords and authentication codes that allow attackers to steal the information. Which results from social engineering rather than vulnerabilities in the vendors’ infrastructure [4]. You can check the more information how they did in details:
https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft
With that said, you need to be extremely careful with stuff you received from an email, a call, or even a person when handling sensitive information.
Sources
- Federal Bureau of Investigation (FBI) / IC3. "ShinyHunters: Cyber Criminal Group Attacks Learning Management System." May 15, 2026. ic3.gov
- U.S. Attorney's Office, Western District of Washington. "Member of notorious international hacking crew sentenced to prison." January 9, 2024. justice.gov
- Cybersecurity and Infrastructure Security Agency (CISA). "Individuals and Families." cisa.gov
- Mandiant and Google Threat Intelligence Group (GTIG). "Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft." January 31, 2026. cloud.google.com
- Mandiant and Google Threat Intelligence Group (GTIG). "ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft." September 26, 2026. cloud.google.com
