In June 2026, retailer <a href="https://breachnews.com/breaches/shinyhunters-threatens-council-of-europe-american-tower-jcpenney-and-others-with-imminent-data-leaks/" target="_blank" rel="noopener">JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign</a>. Data allegedly obtained from JCPenney through the exploitation of <a href="https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit" target="_blank" rel="noopener">a critical zero-day vulnerability in Oracle PeopleSoft</a> was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses.

JCPenney

On 18 June 2026, the latest phase of <a href="https://www.politie.nl/en/news/2026/june/18/international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html" target="_blank" rel="noopener">Operation Endgame targeted the SocGholish malware operation</a>, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities also provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords.

OperationEndgame4

Operation Endgame 4.0

In June 2026, fashion retailer <a href="https://cybernews.com/security/ralph-lauren-data-breach-claims/" target="_blank" rel="noopener">Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign</a>. The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups.

RalphLauren

Ralph Lauren

In March 2026, the financial consulting and advisory firm <a href="https://x.com/AlvieriD/status/2029785330677936135" target="_blank" rel="noopener">CFGI was the target of a ShinyHunters "pay-or-leak" extortion campaign</a>. The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.

CFGI

In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to <a href="https://haveibeenpwned.com/Passwords">Pwned Passwords</a> and are now searchable. Individuals can view any records captured against their email address in <a href="https://haveibeenpwned.com/Dashboard/Redirect/StealerLogs">the stealer logs section of their dashboard</a>. Organisations can see logs affecting their domain via <a href="https://haveibeenpwned.com/API/v3#StealerLogsOverview">the stealer logs API</a>.

June2026StealerLogs

June 2026 Stealer Logs

In March 2026, the commercial real estate finance company <a href="https://x.com/AlvieriD/status/2034584125106000005" target="_blank" rel="noopener">Berkadia was the target of a ShinyHunters "pay or leak" extortion campaign</a>. The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.

Berkadia

In March 2026, the student information system <a href="https://www.bleepingcomputer.com/news/security/infinite-campus-warns-of-breach-after-shinyhunters-claims-data-theft/" target="_blank" rel="noopener">Infinite Campus was targeted in a ShinyHunters "pay or leak" extortion campaign</a>. The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. <a href="https://www.reddit.com/r/k12sysadmin/comments/1s12xx7/infinite_campus_incident/" target="_blank" rel="noopener">Infinite Campus subsequently sent notifications</a>, advising that the exposed data largely consisted of "names and contact information for school staff" and that "the majority is directory information commonly found on school websites".

InfiniteCampus

Infinite Campus

In June 2026, <a href="https://www.bbc.com/news/articles/ckg0lkp042zo" target="_blank" rel="noopener">the University of Nottingham was the target of a cyber attack</a>, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. <a href="https://www.nottingham.ac.uk/currentstudents/news/student-and-alumni-data-has-been-compromised-in-a-data-security-incident" target="_blank" rel="noopener">In a post about the incident</a>, the university advised that the breach affected both "current students, and alumni".

UniversityOfNottingham

University of Nottingham

In May 2026, the HVAC/R wholesale distributor <a href="https://x.com/DailyDarkWeb/status/2062522924582502737" target="_blank" rel="noopener">Baker Distributing Company was added to the ShinyHunters data extortion group's "pay or leak" site</a>. In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contractor customer base. The exposed data was largely corporate contact and support information with limited sensitivity.

BakerDistributing

Baker Distributing

In May 2026, the corporate travel management company <a href="https://www.ictmagazine.nl/nieuws/shinyhunters-claimt-datadiefstal-bij-groot-internationaal-zakenreisbureau/" target="_blank" rel="noopener">BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign</a>. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets.

BCDTravel

BCD Travel

The ID is a unique fingerprint that is calculated based on the values of all non-Fusionbase specific columns.

fb_id

name

title

domain

breach_date

added_date

modified_date

pwn_count

description

logo_path

data_classes

is_verified

is_fabricated

is_sensitive

is_retired

is_spam_list

is_malware

is_subscription_free

The ISO-8601 timestamp of when the record was added to the data stream.

fb_datetime

Each new set of records that is added to the data stream gets automatically versioned by Fusionbase.

have i been pwned? - Data Breaches

have i been pwned? - Data Breaches

Attributes

Related Datasets