Ransomware needs a way in. Stolen credentials are the cheapest one.

Note to mr. databroker1 NEXUS DL Service Ransomware Attack

Ransomware victimData extortion

shinyhuntersGroup

—Country

Sep 4, 2026Discovered

Overview

View group profile

Industry

Financial Services

Discovered

about 1 month ago

Confidence

70%

Severity

Medium

Status

Claimed

Threat group

shinyhunters

Total victims

113

First seen

Oct 2025

Last seen

Oct 2026

Group status

active

Sophistication

Impact score

120

Threat level

5.5/10

Aggressiveness7/10

Lethality2.6/10

Criticality7/10

Status breakdown

Data Leaked52.2%59

Negotiating2.7%3

Claimed

this victim

45.1%51

Targeted sectors

Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Victim's position within group

Industry

Financial Services

Known target sector

Other victims

View all (113)

Same group · shinyhunters

DexCom, Inc.
—
Claimed
O'Reilly Automotive
—
Claimed
WARNING
—
Negotiating
Final statement re PSA
—
Claimed
PRESS RELEASE RE PSA
United States
Data Leaked
Fresenius Medical Care
Germany
Claimed

Group activity

Monthly attacks · shinyhunters

113

total · avg 10.3/mo