#extortion
12 articles
Across 12 articles published between 14 April and 9 October 2026, ZCyberNews tracked extortion activity tied to ShinyHunters and BlackFile. Coverage centered on CVE-2026-35273, alongside the wider campaigns these actors pursued. Education and government featured most often among affected sectors, with law enforcement, cryptocurrency, and education also appearing. Incidents spanned North america, Global, United states, Canada, and Jordan. Severity skewed heavily toward high ratings, with 11 of the 12 articles rated high and one medium. The archive below collects that reporting in full.
HIGHFBI Arrests Third ShinyHunters Suspect Over FBI Breach
FBI arrested a Canadian national in Pennsylvania, its third ShinyHunters arrest in two weeks, after the group breached FBIjobs.gov and stole data on nearly every FBI employee.
HIGHShinyHunters Claims FBI Breach, Leaks 5,000 Agent Records
ShinyHunters defaced fbijobs.gov and gave the FBI one week to retract a May PSA, claiming 2-3 TB stolen via a PeopleSoft flaw tracked as CVE-2026-35273.
HIGHGrafana GitHub Token Breach Lets Attacker Download Full Codebase
An attacker used a compromised GitHub token to download Grafana's entire private codebase. The company says no customer data was accessed and the incident involved an extortion...
HIGHInstructure Pays ShinyHunters to Halt 3.65TB Canvas Data Leak
ShinyHunters agreed to delete 3.65TB of stolen Canvas data after Instructure paid an undisclosed ransom. The breach affects thousands of schools and universities worldwide.
HIGHShinyHunters Breaches Vimeo, Leaks 119K User Records
ShinyHunters leaked a 106GB archive of Vimeo data after breaching Anodot, exposing emails and names of 119,200 users. No credentials or payment info compromised.
HIGHInstructure Data Breach: ShinyHunters Claims Theft
ShinyHunters claims to have stolen data from Instructure, the edtech firm behind Canvas LMS. Instructure confirms a breach involving unauthorized access to certain systems and…
HIGHADT Confirms Breach as ShinyHunters Leaks Customer Data
ADT confirmed a data breach after ShinyHunters leaked 30,000+ customer records including names, emails, and account details from a compromised Salesforce instance.
HIGHBlackFile Extortion Group Targets Retail, Hospitality via Vishing
BlackFile extortion group has hit at least 12 retail and hospitality organizations since Feb 2026, using vishing to steal VPN credentials and exfiltrate data before demanding…
HIGHMcGraw Hill Breach: ShinyHunters Leaks 13.5M User Records
ShinyHunters published data from 13.5 million McGraw Hill accounts — names, emails, institutional affiliations — stolen from a misconfigured Salesforce instance.
HIGHMcGraw-Hill Data Breach Exposes 13.5 Million Users via Salesforce
Education publisher McGraw-Hill confirms a data breach exposing 13.5 million users' personal data, linked to a misconfigured Salesforce environment. Over 100GB of stolen data has been publicly distributed online following an extortion attempt.
HIGHKraken Faces Extortion After Insider Breach Exposed Bug Bounty Flaw
Kraken's security team discovered an insider breach where a researcher exploited a zero-day flaw to steal $3 million in crypto, then demanded a bug bounty payment.
MEDIUMMcGraw-Hill Data Breach Linked to Exploited Salesforce Misconfiguration
McGraw-Hill breached via a misconfigured Salesforce instance — ShinyHunters claim 13.5M user records exposed. Root cause, scope of access, and what educators and SaaS admins should check now.
Stay Updated
Get the latest cybersecurity news delivered to your inbox.