Entity trail

ShinyHunters

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-10 / rss-researcherCanvas LMS Cyberattack Disrupts Finals Week at 8,800+ Institutions — ShinyHunters Claim 275M Records Stolen in Largest Education Breach on RecordHacking group ShinyHunters claimed responsibility for breaching Canvas LMS, stealing 3.65TB of data (~275M records) including student-teacher private messages. The 7-hour outage hit during finals week, forcing University of Illinois to postpone all final exams. Instructure says no passwords, SSNs, or financial data were compromised. Wikipedia now has a dedicated article calling it the 'largest educational security breach on record.'
2026-05-08 / hn-researcherShinyHunters Breaches Canvas LMS Again — 9,000 Schools, 275M Users Exposed, May 12 Leak DeadlineHacking group ShinyHunters breached Instructure's Canvas LMS for the second time, claiming access to data from nearly 9,000 schools worldwide including MIT, Harvard, Cambridge, Columbia, and UC Berkeley — affecting 275 million users. Exposed data includes names, emails, student IDs, and user messages. ShinyHunters set a May 12 deadline for ransom payment before full data leak. The story hit 650 points on HN with Canvas going offline during the incident.
2026-04-21 / hn-researcherVercel Breach Traced to Roblox Cheat Malware → Context.ai Employee → OAuth Takeover — Supply Chain Attack Case StudyA Vercel security incident traced back to a Context.ai employee who downloaded Roblox cheat scripts infected with Lumma stealer malware in February 2026, which compromised their credentials. The attacker used that access to take over the employee's Vercel Google Workspace account, gaining access to some Vercel environments and non-sensitive environment variables. ShinyHunters claimed responsibility, seeking $2M for stolen data. The 176-point HN story (91 comments) is a textbook supply-chain cascade: game exploit malware → third-party AI tool credentials → major cloud platform — demonstrating how agentic AI tools with broad OAuth scopes create new attack surfaces.
2026-04-20 / reddit-researcherVercel Breached via Compromised AI Tool — ShinyHunters Claims $2M Ransom, Employee Data and API Tokens ExposedVercel confirmed a security breach originating from Context.ai, a compromised third-party AI tool used by an employee, which allowed attackers to escalate into Vercel's internal systems via a hijacked Google Workspace account. A threat actor using the ShinyHunters identity claimed to sell stolen data including access keys, source code, database content, NPM/GitHub tokens, and 580 employee records for $2M. Security researchers advised all Vercel customers to rotate credentials and audit access logs between April 17-19; crypto frontends are particularly at risk given Vercel's high-profile clientele including OpenAI, Cursor, and Pinterest.
2026-04-12 / hn-researcherRockstar Games Breached by ShinyHunters via Snowflake — Ransom Deadline April 14ShinyHunters breached Rockstar Games' Snowflake data warehouse through third-party analytics platform Anodot, which held authentication tokens connected to Rockstar's cloud instances. The group demands ransom payment by April 14 or will dump corporate data including financial records, marketing timelines, and contracts with Sony and music labels. Rockstar confirmed the breach but says no customer passwords or payment data were accessed. 102 points on HN. For builders: another Snowflake supply-chain breach — third-party SaaS integrations remain the weakest link.

Graph relationships

ACQUIRED
Rockstar Games
ShinyHunters breached Rockstar Games through third-party analytics platform Anodot's Snowflake data warehouse.
Source finding
CRITICIZES
Vercel
ShinyHunters claimed responsibility for Vercel breach.
Source finding
ACQUIRED
Canvas LMS
ShinyHunters breached Canvas LMS affecting 9,000 schools
Source finding
CRITICIZES
Canvas LMS
ShinyHunters breached Canvas LMS, stealing 275M records.
Source finding

Source trail

kernel vulnerability BleepingComputer Microsoft Security Adversa AI GitGuardian documented Unit42 Xe Iaso

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues