Refusal Has a Price List: ShinyHunters’ Summer Run from a Home-Alarm Brand to America’s Medicine Supply Chain- 349

September 10, 2026

Between the last days of July and the first of September 2026, the extortion crew ShinyHunters hit four companies with little in common: a home-security brand, a cloud communications provider, a workwear retailer, and the distributor that moves roughly a third of North America’s medicines. What they shared was how they were entered and the choice they were then offered. None was encrypted, locked out or knocked offline in the manner of classic ransomware. Each was reached through a person, a credential or a vendor-hosted platform, stripped of data and handed a deadline. RingCentral and Carhartt refused, and their customers’ details were dumped within days, while the demands climbed from a few million dollars to more than fifty-five million. The summer also produced the most effective answer yet to the crew’s leverage: an independent audit showing that its headline numbers had been padded with synthetic records. It ended on a question no advisory has answered. What does a state do when a decentralised criminal group, rather than a foreign intelligence service, holds a lever over its national health supply chain?

The spring campaign that InfoSources has already traced, from 7-Eleven and Carnival to the Canvas outage that held thousands of schools hostage during final exams, ended with Instructure paying and the FBI warning others not to. The summer showed what the crew does with companies that take that advice. The first sign came from Brinks Home, the residential alarm provider that has had nothing to do with the Brink’s Company since a 2010 sale, and whose parent Monitronics has twice filed for bankruptcy since 2019. In late July the company acknowledged unauthorised access to part of its IT systems and said the intruder was threatening to publish what it had taken. It named neither the attacker nor the system. The leak-site monitor Ransomware.live filled in what the company left out. ShinyHunters claimed more than 4.9 million records from Brinks Home’s Salesforce instance, “containing some PII”, and threatened both a leak and “several annoying digital problems” unless the company opened negotiations by Thursday 30 July. Brinks Home said its alarms and monitoring were unaffected, and it has not said whether it ever made contact. The claim fits a pattern Salesforce itself had flagged: a known group scanning for public-facing Salesforce instances and getting in through misconfigured guest accounts. That pattern sat behind the roughly one hundred corporate Salesforce intrusions the crew claimed earlier in the year.

RingCentral was given the same 30 July deadline. The communications platform disclosed on 28 July that it had been “the target of a sophisticated social engineering campaign” affecting a “limited portion” of its customers. It said it had brought in an outside forensic firm and had seen no further unauthorised activity after remediation. The crew later described the method to The Register in one sentence: it had voice-phished an employee into handing over a password. Vishing has been ShinyHunters’ preferred entry route for most of the year. It claimed more than 623 gigabytes of data. When the deadline passed without payment, it posted the material on 3 August, complaining that the company had failed to reach an agreement “despite our incredible patience, all the chances and offers we made”. By mid-August Have I Been Pwned had loaded 1.6 million unique email addresses tied to RingCentral, together with names, physical addresses and phone numbers. That figure is far more modest than the gigabyte count suggested. The gap between a crew’s volumetric boast and the number of real people affected would become the central story of the next case. The same Register reporting placed RingCentral in a much wider run: hundreds of organisations breached since January, including education-technology providers and healthcare firms. Among them was Abbott’s cancer-diagnostics business, whose leak contained 10.9 million unique email addresses with personal and health data. The reporting appears to attach to that leak the crew’s further claims of more than 30 million customer rows, over a million Social Security numbers, and more than 22 million rows of clinical notes recording doctor-patient conversations. The analyst Dominic Alvieri called ShinyHunters his “top threat group”, and “probably” the top group for most analysts.

Carhartt turned the summer from a list of victims into a test of the crew’s arithmetic. ShinyHunters claimed the workwear retailer on 13 August, after talks over a $3.3 million demand collapsed. It published what the company had reportedly written to it: “After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions.” It mocked the “very unskilled and incompetent negotiator” Carhartt had hired, dumped about 50 gigabytes of data, and described a haul of customer, employee and loyalty data running to “millions of records”. The company, which runs about sixty US stores and employs around three thousand people, has said nothing publicly. The independent count therefore fell to Troy Hunt. He traced the records to Carhartt’s Databricks analytics platform, a vendor-hosted data warehouse rather than a retail system. His email extractor first returned nearly 25 million addresses. An AI-assisted pass then picked out the marks of TPC-DS, a standard generator of synthetic benchmark data: plausible first and last names attached to random domains such as “lkvb06fkzsjv.org”, millions of .edu and .org addresses that made no sense for a clothing brand, more customers registered in Montenegro than in the United States, “customers” in Benin, and a suspicious cluster of birth dates in the early 1900s. Removing the fabricated records brought the total down from 24.8 million to 13.6 million. Hunt’s manual pruning of duplicate and deactivated accounts brought it to 12,933,413, roughly half the crew’s implied figure. Of those, 83 percent had already appeared in earlier breaches, and more than 15,000 were tied to Carhartt employee addresses. The genuine data is real enough: names, email addresses, phone numbers and home addresses. Several aggregators reported the 12.9 million figure as the size of the breach without saying it was the residue left after half the dataset had been thrown out as fake.

The padding is not a curiosity. It is part of how the extortion works. A crew that sells silence is pricing a fear, and that fear grows with the headline number: notification obligations, regulatory exposure, class-action risk and the reputational damage the victim imagines. Inflating the count raises the price of refusal before any negotiation begins. Hunt’s own conclusion was dry: “you can’t always take criminals at their word.” The practical lesson is sharper. Until a trusted third party has done the slow work of verification, the crew’s figure is a negotiating position, not a fact. That stage of the breach economy was described in InfoSources’ account of the stolen-data supply chain, and Carhartt is the clearest case yet of verification shrinking an extortionist’s leverage after the fact.

McKesson moved the campaign from consumer data into national infrastructure. Researchers place the intrusion over four days beginning 21 August. The company says it discovered the breach on 25 August, by which point the main theft was over. On the evening of Friday 28 August it filed with the Securities and Exchange Commission and published a notice. On the same evening, ShinyHunters added the company to its leak site. The attackers had reached one or more unnamed third-party applications and exfiltrated data. Chief information and technology officer Francisco Fraga said in an update the next day that the data was linked to a subset of customers in McKesson’s oncology, multispecialty and medical-surgical units; the first reports mentioned only oncology and surgical. He offered affected customers credit monitoring. He warned of “intermittent service degradation” that the company believed might be related, said there was “reasonable assurance” the intruders were gone, and stressed that McKesson was not disconnecting its systems, the usual containment step in a ransomware event. Customers, he said, “can continue to connect to and use our systems and services as intended”. The crew’s demand was reported at more than $55 million, with a deadline of 1 September. That is more than sixteen times what it had asked of Carhartt two weeks earlier, and it reflects the victim’s position. McKesson distributes about a third of the prescriptions, or by its own wording the pharmaceuticals, used in North America. It reported $403.4 billion in revenue for the year to March, $106 billion of it in the last quarter. It is the latest in a run of large healthcare targets this year: the device makers Medtronic and Boston Scientific, and Stryker, whose attack a pro-Iranian persona separately claimed as retaliation, as InfoSources reported in its water-sector analysis. Less than a month before McKesson was hit, Health-ISAC had warned the sector of a rise in successful ShinyHunters attacks.

Flashpoint’s Ian Gray explained why such warnings so rarely prevent the next intrusion. Identity weaknesses make these campaigns “both cheap and scalable”. Because the activity takes place “entirely within vendor-hosted environments using valid, socially-engineered credentials” and looks like routine support or data-warehouse work, it trips no malware alerts. Victims typically learn of the breach only when the extortionists make contact. That is the common thread from Brinks Home’s Salesforce instance through RingCentral’s phished employee and Carhartt’s analytics warehouse to McKesson’s third-party applications. None required an exploit. Each required one human or one integration the defender did not fully control. Seen through the lens of state behaviour, what stands out is how thin the public response has been. Against a group that has spent more than two years extorting some of the world’s largest companies, and that is linked by researchers to the Snowflake, Oracle, Salesforce and Salesloft Drift sprees, the state’s visible tools this summer were a sector-information-sharing warning, an FBI public service announcement issued after Instructure had already paid, and a securities-disclosure regime that now makes the regulatory filing and the leak-site post arrive on the same Friday night. The decision to pay or refuse is being made company by company, by negotiators the crew is free to mock. Refusal now carries a predictable, published cost, and customers bear it. The reporting reviewed here does not show whether McKesson answered its deadline. What is already visible is how the data from each refusal is used afterwards. Addresses leaked from earlier victims such as ADT, Amtrak and Betterment are already being recycled by unrelated scammers into $2,000 sextortion threats in ShinyHunters’ name. The summer’s dumps from RingCentral and Carhartt have joined that same pool of raw material.

Update, 10 September 2026: McKesson's refusal to pay has now carried its price. ShinyHunters told The Register it demanded $55.2 million; the demand was apparently not met, and the data was published. Have I Been Pwned counts about 6.4 million affected people (patients, staff, provider contacts and marketing recipients), with names, addresses, dates of birth and sensitive health details, far below the 284 million documents the group claimed, and without the Social Security numbers it said it held. McKesson has not confirmed the scale. In the same week, Boston Scientific warned it would miss its third-quarter guidance after its own attack, and Veradigm disclosed patient-data theft claimed by The Gentlemen ransomware group.