ShinyHunters Breaches Clop Ransomware Leak Site, Threatens to Extort Rival Gang

ShinyHunters, one of the most prolific cyber extortion groups of 2026, breached the data leak site of rival ransomware gang Clop (also known as Cl0p) on the evening of Friday, September 18, defacing the Tor-hosted page with a taunting message and ASCII artwork of the Pokémon Umbreon.

The attackers claim to have gained full access to Clop’s server, stealing source code, Grav CMS plugins, system and authentication logs, and — critically — the private keys for Clop’s onion service. According to BleepingComputer, which first reported the incident, ShinyHunters said they are still downloading and reviewing the stolen data. “We are still downloading and reviewing [the data],” the group told the outlet.

The defacement message read: “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS... Maybe don’t try to threaten us next time.” The background was replaced with ASCII art of the group’s Umbreon logo, the same image used in a 2020 defacement of HackForums for which ShinyHunters also claimed responsibility. The site now displays a link to ShinyHunters’ own data leak site.

Extortion Plans

ShinyHunters is treating Clop like any other victim. The group has issued a ransom demand, though specific terms vary by report. The Independent reported that ShinyHunters demanded an eight-figure payment to prevent the publication of stolen information, which included access to Clop’s server and source codes. TechRadar, citing Cybernews, reported that ShinyHunters gave Clop 72 hours to pay a ransom or see all files leaked. When asked by BleepingComputer what they planned to do with the access, the attacker replied, “going to extort them.”

The stolen private keys for Clop’s Tor onion service are a particularly potent prize. ShinyHunters told BleepingComputer: “We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL.” This means the attackers could continue to operate Clop’s leak site under its original address even after Clop regains control of its infrastructure.

The breach was enabled by an unauthenticated file upload vulnerability in Grav CMS, the content management system Clop was using. ShinyHunters initially placed a small text file on the server before later replacing the site’s entire content.

Feud Rooted in 2025 Oracle EBS Campaign

The attack is the latest salvo in a long-running dispute between the two criminal groups. According to ShinyHunters, the feud began in 2025 during Clop’s campaign targeting Oracle E-Business Suite servers. The campaign exploited multiple vulnerabilities, including the zero-day CVE-2025-61882, to steal corporate data on a massive scale.

ShinyHunters has claimed that the exploit used by Clop originally belonged to them and was used without permission. Oracle later confirmed that a proof-of-concept exploit released by the joint hacking group Scattered Lapsus$ Hunters (which includes ShinyHunters) matched the exploit used in the Clop attacks.

The conflict escalated when, according to ShinyHunters, a Clop representative threatened to expose the identities of the group’s members and physically harm them. In a message to BleepingComputer, ShinyHunters said: “During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I'll kill you soon.”

Clop’s prosecutor campaign claimed around 120 victims, according to Rebecca Moody, head of data research at Comparitech, who was quoted by The Independent. “To date, the companies involved – 35 have confirmed the claims so far – have issued data breach notifications to nearly 4 million people. That's a lot of data. So, if the exploit was rightly ShinyHunters, this goes some way to explaining why it's out for revenge.”

Secondary Exposure Risk for Victims

The breach raises concerns about secondary data exposure. Moody noted: “What is of concern is another hacking group potentially having access to another group's victims. This doubles the chances of data being leaked.” She compared the situation to the February 2024 hack of Change Healthcare, where the ALPHV/BlackCat group received a $22 million ransom but a second group, RansomHub, also claimed possession of the data. The House Committee on Energy and Commerce later estimated that a third of Americans had their sensitive health information leaked as a result.

DarkReading, in a summary of the incident, reported that ShinyHunters threatened to expose victim payment data, adding to the risk for companies already compromised by Clop.

Javvad Malik, lead CISO advisor at KnowBe4, said in a statement reported by Infosecurity Magazine: “This is a useful reminder that cybercriminal groups are not a single, coordinated ecosystem; they are competitive businesses driven by trust, reputation and money. When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat. For defenders, it reinforces the need to understand not just the technology, but the motivations and behaviors of the people behind the attacks.”

History of Both Groups

ShinyHunters has carried out major attacks against Google, Microsoft, and Ticketmaster, according to The Independent. Infosecurity Magazine noted that the group has been particularly active in 2026, with significant campaigns against users of commonly deployed software-as-a-service providers including Salesforce Experience Cloud and Canvas Learning Management System. The group recently claimed an attack on American healthcare giant McKesson, which distributes medical supplies and pharmaceuticals to over 40,000 customers.

Clop has been active since 2019 and is responsible for a range of disruptive cyberattacks. Infosecurity Magazine reported that the group was behind a ransomware attack and data breach against the University of Phoenix in December 2025 that affected nearly 3.5 million people. Clop also conducted several major ransomware attacks in 2023 by exploiting a security vulnerability in MOVEit Transfer and MoveIT Cloud.

Echoes of Conti’s Collapse

TechRadar noted that the feud recalls the collapse of the Conti group in 2022. Conti publicly supported the Russian government at the start of the Ukraine invasion, leading affiliates to defect and internal messages to be leaked. That fracture spurred the formation of new groups such as Black Basta, Royal, and Quantum, some of which are still active.

Whether the Clop-ShinyHunters conflict escalates into a broader cyber underworld war remains to be seen. For now, ShinyHunters has seized the offensive, controlling Clop’s leak site and threatening to expose the ransomware gang’s own data.