{ "id": "7dc4e39a-f389-4608-944b-c28e249179a6", "created_at": "2026-04-06T00:17:43.293467Z", "updated_at": "2026-04-10T13:12:38.480445Z", "deleted_at": null, "sha1_hash": "cb69e989514284068a4237826f58e3ceb1b50043", "title": "A hacker group is selling more than 73 million user records on the dark web", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 283580, "plain_text": "A hacker group is selling more than 73 million user records on the\r\ndark web\r\nBy Catalin Cimpanu\r\nPublished: 2020-05-09 ยท Archived: 2026-04-05 20:30:55 UTC\r\nImage: ZDNet\r\nA hacker group going by the name of ShinyHunters claims to have breached ten companies and is currently\r\nselling their respective user databases on a dark web marketplace for illegal products.\r\nThe hackers are the same group who breached last week Tokopedia, Indonesia's largest online store. Hackers\r\ninitially leaked 15 million user records online, for free, but later put the company's entire database of 91 million\r\nuser records on sale for $5,000.\r\nEncouraged and emboldened by the profits from the Tokopedia sale, the same group has, over the course of the\r\ncurrent week, listed the databases of 10 more companies.\r\nThis includes user databases allegedly stolen from organizations such as:\r\nOnline dating app Zoosk (30 million user records)\r\nPrinting service Chatbooks (15 million user records)\r\nSouth Korean fashion platform SocialShare (6 million user records)\r\nFood delivery service Home Chef (8 million user records)\r\nOnline marketplace Minted (5 million user records)\r\nOnline newspaper Chronicle of Higher Education (3 million user records)\r\nSouth Korean furniture magazine GGuMim (2 million user records)\r\nHealth magazine Mindful (2 million user records)\r\nIndonesia online store Bhinneka (1.2 million user records)\r\nUS newspaper StarTribune (1 million user records)\r\nhttps://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/\r\nPage 1 of 2\n\nThe listed databases total for 73.2 million user records, which the hacker is selling for around $18,000, with each\r\ndatabase sold separately.\r\nThe hacker group has shared samples from some of the stolen databases, which ZDNet has verified to include\r\nlegitimate user records -- for the samples where user details were provided.\r\nShinyHunters-sample\r\nImage: ZDNet\r\nThe authenticity of some of the listed databases cannot be verified at the moment; however, sources in the threat\r\nintel community such as Nightlion Security, Under the Breach, and ZeroFOX believe ShinyHunters is a legitimate\r\nthreat actor.\r\nSome believe the ShinyHunters group has ties to Gnosticplayers, a hacker group that was active last year, and who\r\nsold more than one billion user credentials on dark web marketplaces, as it operates on a nearly identical pattern.\r\nZDNet has also been gradually contacting victim organizations all week, as the hacker has been putting their\r\ndatabases online for sale.\r\nAt the time of writing, only Chatbooks has returned our email, with the company formally announcing a security\r\nbreach on its website.\r\nUpdated on May 13 to add that StarTribune has asked users to reset their passwords.\r\nUpdated on May 15 to add that The Chronicle of Higher Education is now notifying readers of the security\r\nbreach.\r\nUpdated on May 19 to add that Home Chef has notified customers of its security breach.\r\nEditorial standards\r\nSource: https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/\r\nhttps://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA", "MITRE" ], "origins": [ "web" ], "references": [ "https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/" ], "report_names": [ "a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web" ], "threat_actors": [ { "id": "c071c8cd-f854-4bad-b28f-0c59346ec348", "created_at": "2023-11-08T02:00:07.132524Z", "updated_at": "2026-04-10T02:00:03.422366Z", "deleted_at": null, "main_name": "ShinyHunters", "aliases": [], "source_name": "MISPGALAXY:ShinyHunters", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "6f7f2ed5-f30d-4a99-ab2d-f596c1d413b2", "created_at": "2025-10-24T02:04:50.086223Z", "updated_at": "2026-04-10T02:00:03.770068Z", "deleted_at": null, "main_name": "GOLD CRYSTAL", "aliases": [ "Scattered LAPSUS$ Hunters", "ShinyCorp", "ShinyHunters" ], "source_name": "Secureworks:GOLD CRYSTAL", "tools": [], "source_id": "Secureworks", "reports": null }, { "id": "1609af91-e258-4058-9caa-59e7d171aecb", "created_at": "2022-10-25T16:07:24.491691Z", "updated_at": "2026-04-10T02:00:05.008935Z", "deleted_at": null, "main_name": "Gnosticplayers", "aliases": [], "source_name": "ETDA:Gnosticplayers", "tools": [], "source_id": "ETDA", "reports": null }, { "id": "56d15cc7-f9c1-451f-bdde-8c283e3cf15b", "created_at": "2023-01-06T13:46:39.015288Z", "updated_at": "2026-04-10T02:00:03.181411Z", "deleted_at": null, "main_name": "Gnosticplayers", "aliases": [], "source_name": "MISPGALAXY:Gnosticplayers", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d8dff631-87b0-4320-8352-becff28dbcf1", "created_at": "2022-10-25T16:07:24.565038Z", "updated_at": "2026-04-10T02:00:05.034516Z", "deleted_at": null, "main_name": "ShinyHunters", "aliases": [], "source_name": "ETDA:ShinyHunters", "tools": [], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434663, "ts_updated_at": 1775826758, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/cb69e989514284068a4237826f58e3ceb1b50043.pdf", "text": "https://archive.orkl.eu/cb69e989514284068a4237826f58e3ceb1b50043.txt", "img": "https://archive.orkl.eu/cb69e989514284068a4237826f58e3ceb1b50043.jpg" } }