ShinyHunters claims it breached Clop’s dark-web leak site
ShinyHunters claimed it defaced Clop’s leak site and stole private keys and server data used in the ransomware group’s operations. The claims were reported after the site displayed a takeover message, but the broader extent of access remains unverified.
By DoomRadar · Published on DoomRadar . Updated .
What happened
Clop’s dark-web data-leak site was defaced with a message claiming it had been taken over by ShinyHunters, with altered background artwork. [1][2][3]
References for this detail (3)
- ShinyHunters Claim Hack of Rival Ransomware Gang Clop - Infosecurity Magazineinfosecurity-magazine.com · Recorded source date: Sep 21, 2026, 3:17 PM UTC
- Cyber Extortion War: ShinyHunters Holds Rival Clop to Ransomgovinfosecurity.com · Recorded source date: Sep 22, 2026, 12:46 AM UTC
- Cyber Extortion War: ShinyHunters Holds Rival Clop to Ransombankinfosecurity.com · Recorded source date: Sep 22, 2026, 12:16 AM UTC
ShinyHunters claimed it stole private keys and server data used to operate Clop’s ransomware activities. [1]
References for this detail (1)
- ShinyHunters Claim Hack of Rival Ransomware Gang Clop - Infosecurity Magazineinfosecurity-magazine.com · Recorded source date: Sep 21, 2026, 3:17 PM UTC
The attackers’ message linked to ShinyHunters’ own data-leak site and reportedly listed Clop among its victims. [1][2][3]
References for this detail (3)
- ShinyHunters Claim Hack of Rival Ransomware Gang Clop - Infosecurity Magazineinfosecurity-magazine.com · Recorded source date: Sep 21, 2026, 3:17 PM UTC
- Cyber Extortion War: ShinyHunters Holds Rival Clop to Ransomgovinfosecurity.com · Recorded source date: Sep 22, 2026, 12:46 AM UTC
- Cyber Extortion War: ShinyHunters Holds Rival Clop to Ransombankinfosecurity.com · Recorded source date: Sep 22, 2026, 12:16 AM UTC
Context from the sources
The incident was described as part of a feud between the two cybercriminal groups that began in 2025. [1]
Reporting linked the dispute to Clop’s alleged targeting of Oracle E-Business Suite users, though the extent of any resulting access or data exposure is not established here. [2][3]
Explore the sources and reporting timeline
3 source links · 3 domains
These counts describe the references, not independent confirmations. Different outlets can repeat the same original report.
1 of these links repeat a headline already present, allowing for punctuation and publisher branding. Repeated wording is not additional confirmation.
Source timeline
Oldest to newest among the available source dates, not a chronology of the incident. Article publication dates come from the source; other recorded dates may reflect when a link was found.
- [1] ShinyHunters Claim Hack of Rival Ransomware Gang Clop - Infosecurity Magazineinfosecurity-magazine.comReferenced for: detail 1, detail 2, detail 3
- [3] Cyber Extortion War: ShinyHunters Holds Rival Clop to Ransombankinfosecurity.comReferenced for: detail 1, detail 3
- [2] Cyber Extortion War: ShinyHunters Holds Rival Clop to Ransomgovinfosecurity.comReferenced for: detail 1, detail 3
What this could mean for you
Organizations associated with Clop may face heightened concern about possible exposure of victim or operational information.
A genuine compromise of Clop’s servers or keys could reveal data connected to its extortion operations.
Reported basis: [1][2][3] · The possible effect is interpretation.
Depends on: The claimed theft must be independently confirmed and shown to include victim or access data.
Possible consequences, not a forecast. Their relevance depends on your location and the conditions above.
For your country
Choose a country to check how this event could affect you.
What changes the outlook
Risk increases if…
Independent confirmation that private keys or victim data were stolen.
Evidence that exposed credentials or infrastructure are being reused in further attacks.
Pressure eases if…
Confirmation that the defacement was limited to the public leak site without access to operational systems.
Still unclear
Whether ShinyHunters actually obtained the claimed private keys and server data.
Whether the incident affects Clop’s ability to conduct further attacks or exposes additional victim data.
Market implications
Market impact
Sources (3)
References for the reported details. Separate links do not necessarily mean independent confirmation.
Available excerpt
The ShinyHunters hacking and extortion gang has claimed a cyber-attack against a fellow cybercriminal outfit, the Clop ransomware group. The incident, which came to light…A short excerpt from our source record; open the original for the full article.
Available excerpt
When cybercriminals fight each other, it's at least entertaining. Enter serial cyber extortion group Cl0p, which is under fire from rival operation ShinyHunters, which claims…A short excerpt from our source record; open the original for the full article.
Available excerpt
When cybercriminals fight each other, it's at least entertaining. Enter serial cyber extortion group Cl0p, which is under fire from rival operation ShinyHunters, which claims…A short excerpt from our source record; open the original for the full article.
AI-assisted analysis · . Based on linked headlines and available excerpts. Methodology · Report an error.