ShinyHunters Breaches Clop Ransomware Leak Site, Threatens to Expose Gang's Data

The ShinyHunters hacking collective has breached the dark web data leak site of the rival Clop (aka Cl0p) ransomware group, defacing the Tor site and stealing sensitive server data, according to multiple cybersecurity outlets. The attack, first reported by BleepingComputer, took place on the evening of Friday, September 18, 2026.

ShinyHunters defaced Clop’s Tor site with a message reading “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS... Maybe don’t try to threaten us next time,” and replaced the background with ASCII art of the Pokémon Umbreon, a logo the group has used in previous defacements. The attackers claimed to have gained “full access” to Clop’s server by exploiting an unauthenticated file upload vulnerability in the Grav CMS that Clop was using, as reported by BleepingComputer and Cybernews.

According to statements ShinyHunters gave to BleepingComputer, the group stole source code, Grav CMS plugins, system logs from the /var/log directory, and the private keys for Clop’s Tor onion service. “We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL,” the group told BleepingComputer. The stolen logs may include authentication records and IP addresses of users who connected to Clop’s server, potentially enabling identification of gang members.

ShinyHunters said it is still reviewing the stolen data and intends to extort Clop, demanding an eight-figure payment to prevent publication of the information, as reported by The Independent. The group added Clop to its own data leak site and gave the ransomware gang 72 hours to respond.

**Feud Dating to 2025 Oracle Campaign**

The attack is the latest escalation in a long-running feud between the two criminal groups, with origins in Clop’s 2025 campaign targeting Oracle E-Business Suite servers. That campaign exploited multiple vulnerabilities, including the zero-day CVE-2025-61882, to steal data from organizations on a massive scale.

ShinyHunters claims the exploit used in those attacks originally belonged to them and was obtained and used by Clop without permission. According to ShinyHunters’ account to BleepingComputer, a Clop representative later threatened to expose the group’s identities and physically harm them. “During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I'll kill you soon,” ShinyHunters told BleepingComputer. The defacement message’s “don’t try to threaten us” line appears to reference this exchange.

**Risk of Secondary Data Exposure**

Security experts warn that one hacking group gaining access to another’s victim data doubles the risk of sensitive information being leaked. Rebecca Moody, head of data research at Comparitech, told The Independent that of the roughly 120 victims claimed by Clop in the Oracle EBS campaign, 35 have confirmed the breach, issuing data breach notifications to nearly 4 million people. “What is of concern is another hacking group potentially having access to another group's victims. This doubles the chances of data being leaked,” Moody said.

The situation recalls the Change Healthcare breach in February 2024, when the ALPHV/BlackCat group received a $22 million ransom but a second group, RansomHub, also claimed possession of the data, according to The Independent.

**Broader Cybercrime Implications**

Javvad Malik, lead CISO advisor at KnowBe4, told Infosecurity Magazine the incident is a reminder that cybercriminal groups are not a unified ecosystem. “When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat. For defenders, it reinforces the need to understand not just the technology, but the motivations and behaviors of the people behind the attacks,” Malik said.

The feud echoes the collapse of the Conti ransomware group in 2022, when internal tensions and leaks led to its fragmentation, according to TechRadar. Conti splintered into groups including Black Basta, Royal, and Quantum, some of which remain active.

ShinyHunters is one of the most prolific extortion groups of 2026, with significant campaigns against software-as-a-service providers including Salesforce Experience Cloud and Canvas Learning Management System, as well as a recent attack on healthcare giant McKesson, according to Infosecurity Magazine. Clop has been active since 2019 and was behind a December 2025 attack on the University of Phoenix affecting nearly 3.5 million people, and a major 2023 campaign exploiting MOVEit Transfer vulnerabilities.

As of press time, Clop has not publicly responded to the breach, and ShinyHunters has not yet published the ransom demand for Clop on its website.