The IT Nerd

The online automotive-marketplace CarGurus is the latest victim of the ShinyHunters campaign after the group published a 6.1 GB dataset of approximately 12.4 million account records on February 21.

Have I Been Pwned notes that about 70% of the exposed email addresses were previously seen in breach databases, though substantial fresh data appears to be included. Analysis by the breach monitoring site indicated that the archive included:

• Email addresses
• IP addresses
• Full names
• Phone numbers
• Physical addresses
• User IDs
• Finance application data
• Dealer account details

CarGurus has not publicly confirmed the breach or provided an official statement.

In a separate but related incident, Wynn Resorts confirmed that hackers accessed employee data after the company appeared on ShinyHunters’ data leak portal on February 20 when the hackers claimed to have stolen more than 800,000 records containing PII (including SSNs) and employee data along with an extortion threat demanding a ransom of 22.34 bitcoin (roughly $1.5 million). 

Since then, the company stated that the alleged attackers claimed the stolen data had been deleted, and as of the latest reports, Wynn has not observed evidence that the information was publicly leaked or misused. 

Although the method used to obtain the data has not been confirmed, ShinyHunters, a cybercrime group known for ransom-or-release tactics, has a history of carrying out advanced voice phishing campaigns that have led to breaches targeting more than 100 organizations, including Optimizely, Figure, Panera Bread, and Crunchbase.

Denis Calderone CRO & COO, Suzu Labs:

   “ShinyHunters is basically operating what feels like an extortion assembly line. In the last few months we’ve seen over a dozen, high-profile organizations get hit: Panera, SoundCloud, Match Group, CarGurus, Wynn, and the list keeps growing.

   “The speed and volume here is what should concern security leaders. They have obviously found something that works here, and it seems that just one well-placed One phone call is all it takes, and they are getting access to your every connected SaaS app in the environment.

   “The Wynn situation is particularly interesting. They appear to have reached an agreement, and the listing was pulled. ShinyHunters has a track record of honoring these deals, AT&T being the most public example. So, paying apparently works, which makes this an agonizing decision for any executive sitting across the table from legal counsel right now. But none of us should want to fund what is clearly a thriving criminal enterprise. Every payment validates the model and funds the next wave of attacks.

   “That’s why the conversation needs to stay focused on preventing the breach, not negotiating after it. Segment your data, lock down SSO with phishing-resistant MFA, and make your environment painful enough to navigate that these groups move on to the next target. Let’s face it, the era of hardware-backed authentication, is upon us.”  

Rajeev Raghunarayan, Head of GTM, Averlon:

   “What ShinyHunters keeps demonstrating is that you don’t need a sophisticated exploit when permissions do the work for you. Once attackers compromise a single set of credentials, SSO and broad SaaS integrations turn that one access point into keys to dozens of systems. The entry is simple. The blast radius is anything but.

   “Organizations are still measuring risk by how hard it is to get in, when the more urgent question is how far an attacker can move once they’re there.”

ShinyHunters is one of those groups that I cannot stop writing about seeing as I wrote about them just yesterday. That’s bad for all of us as it is highly likely that we will hear more from them in the coming days and weeks ahead.

The ShinyHunters extortion gang has claimed responsibility for breaching Dutch telecommunications provider Odido and stealing millions of user records from its compromised systems.

Commenting on this news is Lidia Lopez, Senior Threat Intelligence Analyst at Outpost24:

“This incident fits a pattern we have been tracking from 2025 into 2026: ShinyHunters-linked operations often rely on social engineering to get legitimate access into SaaS environments, then export data and use leak sites for extortion. The common playbook is email and phone pretexting where attackers impersonate IT, a vendor, or support and push a fake “required update” or “security tool,” or trick staff into authorizing a rogue connected app. That gives them access through the identity layer, which can open downstream systems like customer support and contact platforms used across many organizations.

For Odido, “ShinyHunters” claims the breach is larger and includes “plain text” passwords, but that specific claim should be treated as unverified until independently validated or confirmed by the company or the authorities. Researchers suspect that the “plain text password” could refer to a readable password-like field in a CRM, such as a customer-service verification word stored in Salesforce, rather than customers’ online login passwords. Either way, plain text storage is serious: if it is a verification word, it makes impersonation and account fraud much easier when combined with identity data and financial identifiers; if it is an actual login password, it enables immediate account takeover at scale because attackers do not need to crack anything and password reuse can cascade the impact far beyond Odido.”

This is big as Odido has 6.9 million customers as of January 2024. So it is a safe bet that this will not end well for any of those customers. Which highlights the fact that all efforts need to be taken to keep the bad guys out so that conversations like this are not the norm.