Group:
Shinyhunters
Discovered by ransomware.live: 2026-03-15
Estimated attack date:
2026-03-15
Country:
Description:
Over 2M records containing PII and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care. | Size: 12GB (compressed) | Updated: 15 Mar 2026 | SHA256: 0d5bf85c7865b023266adc95a7449dd1bff6b208b4634976441ce5ee650894d0
Infostealer activity detected by HudsonRock
Compromised Employees: 0
Compromised Users: 8538
Third Party Employee Credentials: 14
External Attack Surface:
49
DNS Records:
The following DNS records were found for the victim's domain.
- mxa-002d6401.gslb.pphosted.com.
- mxb-002d6401.gslb.pphosted.com.
- fortifi-domain-verification=vDRyeQQSAKsKnMab5fLzhN5X4I19vqJ6mfqEQEiju6Nr6x5fAzxhbhx9HkooDxhq
- mongodb-site-verification=pKxljzBmk886ZnXOINxFKRtFGx2z9EIc
- apple-domain-verification=46WDljCvpEU07KBe
- shopify-verification-code=HX2GIcGUnouCon1X0oEo7J7GKjMoxY
- google-site-verification=i42gS2IWQPwcCiDEU5y5d1YyOfC8LLiF4uoXWXlj0lo
- cloudflare_dashboard_sso=985d6b1c9328135953ecf785dcd142a6
- google-site-verification=qwAd41pWl-MQgVh8jYyrC7WlEyCqw8TXHR7kwiz55Y0
- E5D7242197
- google-site-verification=OKC6X2WGadQfkHIjr6Mpfewas_Yg48iCYZtTu64TiFI
- google-site-verification=3_JtqncBcQ9P6gQff2BKXedSRhXoI8I2z8R2g7jjvAg
- google-site-verification=tnvOkX9IEVyXLVdBhaNH5E0nQrenhmmk78JCrtXo2WM
- anthropic-domain-verification-55a1x1=O1jyopTz83c2M3scyw6iI9kU2
- google-site-verification=hoaay7fTHaE5lRYFfgtK2PwOTxbkWZZqgEBCJ8vNjU4
- docusign=71355ca6-7626-495b-872b-2065a0c240ad
- google-site-verification=s_3auwg6rOIakeNtM19_lyhygU8qzF2HqXae4koa66E
- google-site-verification=ZdaYxfy6GriFoffioKg1qCopdALgdnpUspopzwOdm5U
- jamf-site-verification=ahy4EYhOSoyxOtbbMuWbhA
- adobe-idp-site-verification=53171ecdb9e4679c8ba832d60e5236322412b790674bceb59149b71570789fd
- v=spf1 include:_u.aura.com._spf.dmarcly.com -all
- openai-domain-verification=dv-iaZQihFxBBiIEy4ZNNFQd2KW
- cursor-domain-verification-m0hpkb=sprQTcdC3rnkygRrTDsGMLfCY
- ZOOM_verify_PY8yb8_uR-ytnv0sgZRFzg
- asv=7933e3e09ee69e65f438338430dedfb4
- atlassian-domain-verification=kVITiDDMnBQ4t/6Ys2uLhlFdwbku6i8zQI0m6DYsTOM3c/lwUtPK+azsjTEfwlN1
- google-site-verification=3d2gL34s4rvAcKoxHCIk8u9fiLJkdZjaNJRrR96P4Gw
- onetrust-domain-verification=ef28e78ab93e42c5ab47ff50f51cdde8
- twilio-domain-verification=641fa0fdc50313a03f612a45df21a95f
- MS=ms47414250
- zapier-domain-verification-challenge=71220365-2fe1-4b30-be81-44bd4ff3ac1a
- hubspot-domain-verification=ZDA4OTZhNTctMDg3Ny00ZDA0LTk1Y2MtYTU1ZjFjYWE5MjZi
Cloud / SaaS Services Detected
Adobe
Apple
Atlassian
Microsoft 365
Twilio
JamF
OneTrust
DocuSign
Proofpoint
Zoom
Legal Disclaimer:
Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
This platform indexes only publicly visible information posted by ransomware operators and
open web sources without accessing or obtaining the underlying stolen content.
The service is provided to support public awareness, legitimate research, and cyber-resilience.
No stolen personal or confidential data is collected or distributed via this site.