# ShinyHunters-Impersonation Sextortion Scam Abuses Emails From 8 Prior Data Leaks, Demands $2,000

> An unidentified threat actor is running a mass sextortion email campaign, active since April 2026, that falsely claims affiliation with the ShinyHunters extortion brand (which publicly denies involvement) to demand $2,000 in cryptocurrency within 48 hours. The scam derives its false credibility entirely from genuine leaked email addresses and breached-company names pulled from eight prior 2025-2026 breaches (Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, McGraw Hill) rather than from any actual device or account compromise.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1685
- **ID:** TL-2026-1685
- **Severity:** LOW
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since April 2026, victims whose email addresses appear in prior breach dumps have received unsolicited extortion emails with the subject line "Information about your online security," sent from spoofed sender display names reading "ShinyHunters" or "You've Been HACKED." The message falsely claims the sender gained device access "a few months ago" via an exploit reaching the victim's microphone, camera, keyboard, browsing history, photos, conversations, and contact list, and that the victim was recorded visiting adult websites. It demands $2,000 in cryptocurrency (BleepingComputer's sampled emails cite Bitcoin; a separately sampled message analyzed by MyAntiSpyware.com cites Litecoin, wallet ltc1qfpjl5999jwpjq7kvyjld9akaspx69qaxvxrf20) within 48 hours, threatening to send the alleged footage to the victim's contacts, and instructs the victim not to contact police or reset devices -- a classic isolation tactic. No independent technical evidence of device or account compromise has been identified in any reporting; the scam's sole leverage is that the target's real email address and the name of a company that previously suffered a breach appear together, lending superficial plausibility.

All eight named prior breaches occurred within the broader 2025-2026 ShinyHunters/Scattered-LAPSUS$-Hunters (SLSH) extortion wave, which primarily abused Salesforce CRM and Salesforce Experience Cloud environments plus stolen Salesloft Drift OAuth/refresh tokens to exfiltrate customer PII at scale: Betterment (breached 2026-01-09 via vishing/social-engineering against a third-party Salesforce vendor, ~1.4M customer records, no passwords exposed), Substack (unauthorized access window opened ~October 2025, detected 2026-02-03, ~700K records -- reporting on this breach does not explicitly attribute it to ShinyHunters, unlike the other seven), Hallmark Cards/Hallmark Plus (claimed by ShinyHunters 2026-03-31, ~7.9M Salesforce records, leak deadline set for 2026-04-02), Amtrak (claimed by ShinyHunters ~2026-04-11/12 via compromised Salesforce, ~2.1M confirmed accounts added to Have I Been Pwned 2026-04-17, ShinyHunters alleged up to 9.4M records), ADT (Salesforce breached "days after" Amtrak per Techlicious, ~5.5M records via Salesforce Experience Cloud misconfiguration), Panera Bread (~5.1M accounts via Salesforce Experience Cloud misconfiguration), CarGurus (named victim, Salesforce-linked), and McGraw Hill (publicly confirmed 2026-04-14 following a ShinyHunters extortion threat; McGraw Hill characterized exposed data as "limited and non-sensitive" while ShinyHunters claimed 45M PII records, a claim not independently verified).

ShinyHunters (aliases/overlapping clusters tracked as UNC6240, UNC6395, UNC6661, UNC6671, UNC6040, and converging with Scattered Spider/Lapsus$ under the "ShinySp1d3r"/SLSH umbrella) publicly denied any role in the sextortion emails when contacted by BleepingComputer. Betterment separately confirmed awareness of the scam, called it "a common extortion scam," and advised customers not to pay. Victim reports have surfaced on Reddit, Facebook groups, and the Better Business Bureau. The pattern matches the long-running, low-technical-sophistication "automated sextortion" scam family (e.g., the 2018 "I know your password" wave and the pattern documented nationally by New York State Police), refreshed here with a topical, credible-sounding brand name and genuinely leaked email/company pairings to raise conversion rates. Severity is assessed LOW because no technical intrusion, malware, or account takeover is confirmed -- the risk is financial/psychological (fear-driven cryptocurrency payment) rather than system compromise -- but the campaign is tracked for SOC awareness/notification purposes and for correlation against the eight source breaches and the wider ShinyHunters activity cluster.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1597 Search Closed Sources
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1598 Phishing for Information
- T1528 Steal Application Access Token
- T1684.001 Impersonation
- T1070 Indicator Removal
- T1556 Modify Authentication Process
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [ShinyHunters data leaks fuel $2,000 sextortion email scam](https://www.bleepingcomputer.com/news/security/shinyhunters-data-leaks-fuel-2-000-sextortion-email-scam/)
- [Fake or Real? We are the ShinyHunters hacking group Email Scam Explained](https://www.myantispyware.com/2026/07/06/fake-or-real-we-are-the-shinyhunters-hacking-group-email-scam-explained/)
- [ShinyHunters Hacking Group Email Scam: What This Fake Sextortion Message Really Means](https://malwaretips.com/blogs/shinyhunters-hacking-group-email-scam-what-this-fake-sextortion-message-really-means/)
- [Betterment data breach exposes 1.4 million customers](https://www.americanbanker.com/news/1-4-million-data-breach-betterment-shinyhunters-salesforce)
- [ShinyHunters Leak Alleged Data of Millions From SoundCloud, Crunchbase and Betterment](https://hackread.com/shinyhunters-leak-soundcloud-crunchbase-betterment-data/)
- [ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks](https://www.huntress.com/threat-library/threat-actors/shinyhunters)
- [McGraw-Hill Salesforce Data Breach 2026: Analysis of ShinyHunters Extortion and Cloud Misconfiguration Risks](https://www.rescana.com/post/mcgraw-hill-salesforce-data-breach-2026-analysis-of-shinyhunters-extortion-and-cloud-misconfigurati)
- [Amtrak quietly loses 2M customer records – and hasn't warned anyone](https://www.techlicious.com/blog/amtrak-data-breach-shinyhunters/)
- [Substack Data Breach Leaks Nearly 700,000 User Records](https://www.cpomagazine.com/cyber-security/substack-data-breach-leaks-nearly-700000-user-records/)
- [New York State Police Warns of Nationwide Automated Sextortion Scams](https://troopers.ny.gov/news/new-york-state-police-warns-nationwide-automated-sextortion-scams)
- [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks](https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/)
- [ShinyHunters Claim Hallmark as Next Victim: 8M Salesforce Records Compromised](https://www.salesforceben.com/shinyhunters-claim-hallmark-as-next-victim-8m-salesforce-records-compromised/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1685