Shinyhunters: articles and guides

Medtronic says an unauthorized party accessed corporate IT systems in April 2026. 3,834,294 notified; ShinyHunters claimed 9M. Confirmed vs claimed.

CarGurus data breach: HIBP counts 12.5M addresses after a ShinyHunters leak. What CarGurus confirmed, what is claimed, the lawsuits and what to do.

KrebsOnSecurity reports (19 October 2026) that U.S. federal investigators suspect an executive at a U.S. consulting firm helped run the ShinyHunters extortion site "shinywire[.]com," and that investigators identified executives at two ransomware-negotiation firms with "unusually close relations" to ShinyHunters. Nothing here is proven against any named individual, and the suspected site-operator is unnamed and uncharged. For CISOs and IR leaders the lesson is structural: the negotiators, IR vendors and "recovery" brokers you bring in mid-incident are themselves a trust boundary. An independent, attributed read on what is alleged versus proven, and how to run conflict-checked, sanctions-screened due diligence on anyone you let into a live ransomware response.

Dutch police arrested a ShinyHunters suspect; days later an Umbreon defacement hit the FBI jobs site, maybe a frame-up. Why attribution is adversarial.

Under Armour data breach and the rest of January 2026: Match Group, Panera, Crunchbase, Nike, Covenant Health, CIRO. Confirmed vs claimed, with sources.