Scammers exploit ShinyHunters breach data in widespread sextortion campaign targeting Amtrak, Hallmark, and others

Threat actors are using email addresses from previously leaked data breaches to send fake sextortion emails demanding Bitcoin, falsely claiming to be the ShinyHunters group.

Key Points:

• Scammers are using email addresses exposed in data breaches from companies like Amtrak, Hallmark, Substack, and CarGurus to send targeted sextortion emails.
• The emails falsely claim the ShinyHunters hacking group compromised devices and recorded intimate activity, demanding $2,000 in Bitcoin to prevent leaks.
• ShinyHunters has denied involvement in this specific campaign, which is actually conducted by unrelated threat actors repurposing leaked data.
• Victims are advised not to pay, reply, or click links, as there is no evidence the scammers have access to their devices or personal data.

A new wave of sextortion scams is leveraging email addresses obtained from data breaches previously leaked by the ShinyHunters extortion group. The emails, which began appearing in April, claim to be from ShinyHunters and allege that the recipients' devices were compromised months ago. The messages assert that hackers accessed cameras, microphones, and browsing history, specifically targeting visits to adult websites, and are now demanding $2,000 in Bitcoin to keep this information private. The scammers use the names of breached companies, such as Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill, to make the threats appear more credible and targeted.

Despite the convincing use of leaked data, the ShinyHunters group has denied any involvement in this campaign. Security experts and affected companies, including Betterment, confirm that these are fraudulent attempts to intimidate victims. The scammers do not have access to the recipients' devices, nor have they recorded any videos or accessed personal files. The use of a leaked email address is merely a tactic to increase the perceived legitimacy of the threat, exploiting the fear that personal data has been compromised.

This campaign highlights how data breaches have long-term consequences, as leaked information can be repurposed by unrelated threat actors for malicious purposes long after the initial exposure. Recipients are strongly advised to ignore these emails, delete them, and avoid any interaction with the sender. Paying the ransom does not guarantee the removal of threats and only encourages further criminal activity. Organizations and individuals should remain vigilant and verify the source of such claims through official channels rather than responding to the email directly.

Learn More: Bleeping Computer

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)