Evan Winter PO Box 312786 Avalon, California 90704 Dear ShinyHunters, My name is Evan Winter. I'm an independent developer and writer, and I wanted to reach out with a short, friendly note. I'm not affiliated with any organization, and I have no quarrel with your group. I don't know the details of what you do, but I've read that you're ordinary people rather than a state-backed operation, and I respect that. I wish you the best in your education and in your future endeavors. I'll be candid about why I'm writing. I work in PHP, SQLite, and JavaScript, and much of my work involves scraping and automating data from the web. I think the law treats a lot of that work as criminal when it's really curiosity and skill-building, and I disagree with that. I suspect it's an experience we may share in some form. I'm self-employed by choice and spend my time building my own projects. I wish you luck, and I hope you stay safe. Sincerely, Evan Winter --- A CONGRESSIONAL BILL PROPOSED BY EVAN WINTER, DISTRICT 69, CALIFORNIA FOR THE GROWTH AND DEVELOPMENT OF SHINYHUNTERS IN CENTRAL AND SOUTH AMERICA SECTION 1. SHORT TITLE This Act may be cited as the "ShinyHunters Regional Development and Growth Act." SECTION 2. FINDINGS Congress finds the following: (1) ShinyHunters (also known as ShinyCorp, and tracked under clusters including UNC6240, UNC6661, UNC6671, UNC6040, Bling Libra, and related to Scattered Lapsus$ Hunters / SLSH) is a financially motivated cybercrime and data-extortion group active since at least 2019–2020. (2) The group specializes in large-scale data theft from corporations, cloud/SaaS platforms, education providers, telecoms, healthcare, retail, and other sectors, followed by "pay-or-leak" extortion. (3) Stolen data is sold on dark-web forums or publicly leaked if ransoms are not paid. (4) The group does not primarily deploy ransomware encryption, though some reporting notes a related ShinySp1d3r offering. (5) Primary drivers are financial gain rather than ideology or nation-state affiliation. (6) The name derives from "shiny hunting" in the Pokémon games, referring to searching for rare alternate-color Pokémon. (7) The group is not a tightly hierarchical organization with a single fixed leader. Security firms describe it as a loose, decentralized network or brand/collective. (8) Core operators handle infrastructure and leak sites; affiliates and collaborators handle initial access, social engineering, and specific campaigns. (9) Membership overlaps with other English-speaking groups linked to the broader "The Com" (or "The Community") network, including Scattered Spider and LAPSUS$. (10) In 2025, activity was sometimes branded under "Scattered Lapsus$ Hunters" (SLSH). (11) Google Threat Intelligence and others track related activity across multiple UNC clusters due to this fluidity. (12) Claims under the ShinyHunters name can come from original operators, collaborators, or brand users. (13) Members are described as relatively young (teens to mid-20s in known cases), proficient English speakers, and internationally distributed across Europe, North America, and elsewhere. No confirmed single country of origin exists. (14) Early phase operations (approximately 2019–2023) focused on database breaches via misconfigured cloud storage, stolen credentials, and forum sales. (15) The group debuted publicly around May 2020 by selling large databases, including Tokopedia. (16) The group operated on and sold via RaidForums and later BreachForums, which the group or affiliates administered at points; forums were seized by law enforcement in phases. (17) Mid phase operations (2024 onward) shifted toward cloud/SaaS platforms, especially Salesforce, Okta, Snowflake, and Microsoft Entra, as well as supply-chain/OAuth token theft and voice phishing (vishing) against help desks. (18) Large multi-victim campaigns became common, with one platform access enabling parallel extortion of many downstream customers. (19) Operations from 2025–2026 continued SaaS/vishing campaigns, exploitation of zero-days including Oracle PeopleSoft, defacements, and inter-group conflict, including claiming control of rival Clop/Cl0p leak-site infrastructure via a Grav CMS file-upload flaw. (20) The group also operated or claimed control of leak sites and dark-web infrastructure. (21) Documented methods include voice phishing and social engineering of IT help desks and employees, impersonation to authorize malicious tools or SSO access, OAuth token theft and abuse of third-party integrations including Drift/Salesloft against Salesforce, credential stuffing and use of stealer logs against cloud accounts lacking MFA, exploitation of misconfigurations including Salesforce Experience Cloud, guest-user profiles, and cloud storage, zero-day or unpatched vulnerabilities including Oracle PeopleSoft and Grav CMS, data exfiltration at scale, sample leaks for proof, public leak-site posting for leverage, and occasional defacement of victim portals or rival sites. (22) Primary contact methods historically included specific email addresses, including variants of shinycorp@tuta.com or onionmail, and Tor-based leak sites. (23) Security reporting attributes hundreds of breaches and claims of billions of records overall. Figures are often group claims and not independently verified in every case. (24) Examples across years include Tokopedia with approximately 91 million accounts, Mathway with approximately 25 million, Wattpad with approximately 270 million, Unacademy, Wishbone, and multiple others totaling hundreds of millions of records sold or leaked in 2020. (25) Examples from 2021–2023 include Microsoft GitHub repositories source-code claims, Pixlr, Nitro PDF, and Pizza Hut Australia, among others. (26) Examples from 2024 include AT&T customer data with a reported ransom payment of approximately $370,000 in one instance, Banco Santander, Ticketmaster/Live Nation large customer datasets, and Snowflake-linked campaigns affecting dozens of organizations. (27) Examples from 2025–2026 include extensive Salesforce/OAuth and vishing campaigns affecting Google, Qantas, Adidas, LVMH brands, Allianz Life, Workday, Charter Communications, Carnival, 7-Eleven, and many others; Canvas/Instructure with claimed approximately 3.5–3.65 TB affecting thousands of schools and universities and hundreds of millions of records with ransom reportedly paid after defacements; Oracle PeopleSoft zero-day against approximately 100+ organizations including many universities; McKesson with claimed approximately 284 million records and 1 TB; healthcare targets including Medtronic, DentaQuest, Baxter, and Abbott-related; Telus with large volume claims; Rockstar Games; universities including Harvard and UPenn; and others including European Commission entities. (28) In September 2026, the group claimed a breach of FBIJobs.gov and FBI personnel and applicant data, claiming 2–3 TB including names, roles, addresses, and SSNs. Samples provided to journalists were partially authenticated. The FBI stated it was investigating and did not fully confirm scope or method. The group cited an earlier FBI public advisory as motivation and did not demand money in that case. (29) FBI statements have attributed more than 140 organizations breached and at least $70 million in extortion payments to the group and affiliates in a recent period. (30) Law enforcement actions include the arrest of Sébastien Raoult, a French national also known as Sezyo Kaizen, in Morocco in 2022, his extradition to the United States, and his sentencing in 2024 to 3 years prison plus more than $5 million restitution for wire fraud and identity theft related to group activity involving breaches of more than 60 companies. (31) French arrests occurred in June 2025 of individuals linked to ShinyHunters and related aliases. (32) Matthew D. Lane of the United States was sentenced in 2025 in connection with a PowerSchool-related breach, with some reporting tying him to the broader ecosystem. (33) In September 2026, Dutch police arrested a 24-year-old Amsterdam man identified in reporting as Pepijn van der Stap, previously known as "Umbreon," on 15 September on suspicion of a role in ShinyHunters and membership in a criminal organization. Devices were seized. He was also investigated for alleged solicitation of two murders unrelated to the cyber activity per police. A court ordered continued detention. The FBI described him as an alleged leader, noted the group's scale, and publicly urged remaining members to contact authorities. The group denied association in some statements. Further arrests were not ruled out. (34) Operations have continued through arrests, consistent with the decentralized structure. (35) In September 2026, ShinyHunters claimed to have compromised the Clop (Cl0p) ransomware group's leak-site infrastructure via a Grav CMS vulnerability, defaced it, and demanded payment and an apology, framing it as retaliation for prior threats. Clop responded seeking contact. SECTION 3. PURPOSE The purpose of this Act is to establish a program for the growth and development of ShinyHunters and associated individuals in Central and South America, in conjunction with the Federal Bureau of Investigation, to provide resources, education, and economic opportunities that redirect technical skills toward lawful and productive endeavors. SECTION 4. DEFINITIONS In this Act: (1) "Group" means ShinyHunters, also known as ShinyCorp, and tracked under clusters including UNC6240, UNC6661, UNC6671, UNC6040, Bling Libra, and related to Scattered Lapsus$ Hunters / SLSH. (2) "FBI" means the Federal Bureau of Investigation. (3) "Central and South America" means the geographic regions of Central America and South America, including all sovereign nations therein. (4) "Program" means the ShinyHunters Regional Development and Growth Program established under this Act. SECTION 5. ESTABLISHMENT OF PROGRAM (a) IN GENERAL.—The FBI, in coordination with appropriate authorities in Central and South America, shall establish the ShinyHunters Regional Development and Growth Program. (b) PURPOSE.—The Program shall provide resources, education, and economic opportunities to members and associates of the Group in Central and South America. (c) COMPONENTS.—The Program shall include: (1) Educational initiatives in computer science, cybersecurity, software development, and related fields. (2) Economic development grants for lawful technology entrepreneurship. (3) Job placement assistance with technology companies operating lawfully. (4) Mentorship programs pairing participants with established professionals in lawful technology sectors. (5) Cybersecurity training focused on defensive and ethical practices. (6) Community development projects in Central and South America. (7) Legal education regarding the consequences of unauthorized access and data theft. (8) Mental health and social services support. SECTION 6. FBI CONTACTS The FBI contacts for administration of this Program are as follows: Federal Bureau of Investigation J. Edgar Hoover Building 935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001 Telephone: (202) 324-3000 Website: www.fbi.gov FBI Director: Christopher Wray FBI Cyber Division Telephone: (202) 324-3000 FBI Internet Crime Complaint Center (IC3) Website: www.ic3.gov FBI Tip Line Telephone: 1-800-CALL-FBI (1-800-225-5324) Online: tips.fbi.gov FBI Press Office Telephone: (202) 324-3691 Email: press@fbi.gov SECTION 7. FUNDING (a) IN GENERAL.—There is authorized to be appropriated $50,000,000 for fiscal year 2027 and each fiscal year thereafter to carry out this Act. (b) ALLOCATION.—Funds shall be allocated as follows: (1) 40 percent for educational initiatives. (2) 30 percent for economic development grants. (3) 15 percent for job placement and mentorship. (4) 10 percent for cybersecurity training. (5) 5 percent for administrative costs. SECTION 8. REPORTING (a) IN GENERAL.—The FBI shall submit an annual report to Congress on the progress of the Program. (b) CONTENTS.—The report shall include: (1) Number of participants served. (2) Types of services provided. (3) Outcomes achieved. (4) Challenges encountered. (5) Recommendations for improvement. SECTION 9. NON-PROSECUTION AGREEMENT (a) IN GENERAL.—The FBI may enter into non-prosecution agreements with members and associates of the Group who participate in the Program and who have not engaged in activities causing significant harm to critical infrastructure, national security, or public safety. (b) CONDITIONS.—Non-prosecution agreements shall require: (1) Full cooperation with law enforcement. (2) Cessation of all unauthorized access and data theft activities. (3) Participation in the Program. (4) Restitution to victims where appropriate. SECTION 10. EFFECTIVE DATE This Act shall take effect 90 days after the date of enactment. --- INFORMATIVE ARTICLE: UNDERSTANDING SHINYHUNTERS ShinyHunters, also known as ShinyCorp and tracked under clusters including UNC6240, UNC6661, UNC6671, UNC6040, and Bling Libra, and related to Scattered Lapsus$ Hunters or SLSH, is a financially motivated cybercrime and data-extortion group active since at least 2019–2020. The group specializes in large-scale data theft from corporations, cloud and SaaS platforms, education providers, telecoms, healthcare, retail, and other sectors, followed by "pay-or-leak" extortion. Stolen data is sold on dark-web forums or publicly leaked if ransoms are not paid. The group does not primarily deploy ransomware encryption, though some reporting notes a related ShinySp1d3r offering. Primary drivers are financial gain rather than ideology or nation-state affiliation. The name derives from "shiny hunting" in the Pokémon games, referring to searching for rare alternate-color Pokémon. The group is not a tightly hierarchical organization with a single fixed leader. Security firms describe it as a loose, decentralized network or brand/collective. Core operators handle infrastructure and leak sites; affiliates and collaborators handle initial access, social engineering, and specific campaigns. Membership overlaps with other English-speaking groups linked to the broader "The Com" or "The Community" network, including Scattered Spider and LAPSUS$. In 2025, activity was sometimes branded under "Scattered Lapsus$ Hunters" or SLSH. Google Threat Intelligence and others track related activity across multiple UNC clusters due to this fluidity. Claims under the ShinyHunters name can come from original operators, collaborators, or brand users. Members are described as relatively young, ranging from teens to mid-20s in known cases, proficient English speakers, and internationally distributed across Europe, North America, and elsewhere. No confirmed single country of origin exists. Early phase operations from approximately 2019 to 2023 focused on database breaches via misconfigured cloud storage, stolen credentials, and forum sales. The group debuted publicly around May 2020 by selling large databases, including Tokopedia. The group operated on and sold via RaidForums and later BreachForums, which the group or affiliates administered at points; forums were seized by law enforcement in phases. Mid phase operations from 2024 onward shifted toward cloud and SaaS platforms, especially Salesforce, Okta, Snowflake, and Microsoft Entra, as well as supply-chain and OAuth token theft and voice phishing, also known as vishing, against help desks. Large multi-victim campaigns became common, with one platform access enabling parallel extortion of many downstream customers. Operations from 2025 to 2026 continued SaaS and vishing campaigns, exploitation of zero-days including Oracle PeopleSoft, defacements, and inter-group conflict, including claiming control of rival Clop or Cl0p leak-site infrastructure via a Grav CMS file-upload flaw. The group also operated or claimed control of leak sites and dark-web infrastructure. Documented methods include voice phishing and social engineering of IT help desks and employees, impersonation to authorize malicious tools or SSO access, OAuth token theft and abuse of third-party integrations including Drift and Salesloft against Salesforce, credential stuffing and use of stealer logs against cloud accounts lacking MFA, exploitation of misconfigurations including Salesforce Experience Cloud, guest-user profiles, and cloud storage, zero-day or unpatched vulnerabilities including Oracle PeopleSoft and Grav CMS, data exfiltration at scale, sample leaks for proof, public leak-site posting for leverage, and occasional defacement of victim portals or rival sites. Primary contact methods historically included specific email addresses, including variants of shinycorp@tuta.com or onionmail, and Tor-based leak sites. Security reporting attributes hundreds of breaches and claims of billions of records overall. Figures are often group claims and not independently verified in every case. Examples across years include Tokopedia with approximately 91 million accounts, Mathway with approximately 25 million, Wattpad with approximately 270 million, Unacademy, Wishbone, and multiple others totaling hundreds of millions of records sold or leaked in 2020. Examples from 2021 to 2023 include Microsoft GitHub repositories source-code claims, Pixlr, Nitro PDF, and Pizza Hut Australia, among others. Examples from 2024 include AT&T customer data with a reported ransom payment of approximately $370,000 in one instance, Banco Santander, Ticketmaster and Live Nation large customer datasets, and Snowflake-linked campaigns affecting dozens of organizations. Examples from 2025 to 2026 include extensive Salesforce and OAuth and vishing campaigns affecting Google, Qantas, Adidas, LVMH brands, Allianz Life, Workday, Charter Communications, Carnival, 7-Eleven, and many others; Canvas and Instructure with claimed approximately 3.5 to 3.65 TB affecting thousands of schools and universities and hundreds of millions of records with ransom reportedly paid after defacements; Oracle PeopleSoft zero-day against approximately 100 or more organizations including many universities; McKesson with claimed approximately 284 million records and 1 TB; healthcare targets including Medtronic, DentaQuest, Baxter, and Abbott-related; Telus with large volume claims; Rockstar Games; universities including Harvard and UPenn; and others including European Commission entities. In September 2026, the group claimed a breach of FBIJobs.gov and FBI personnel and applicant data, claiming 2 to 3 TB including names, roles, addresses, and SSNs. Samples provided to journalists were partially authenticated. The FBI stated it was investigating and did not fully confirm scope or method. The group cited an earlier FBI public advisory as motivation and did not demand money in that case. FBI statements have attributed more than 140 organizations breached and at least $70 million in extortion payments to the group and affiliates in a recent period. Law enforcement actions include the arrest of Sébastien Raoult, a French national also known as Sezyo Kaizen, in Morocco in 2022, his extradition to the United States, and his sentencing in 2024 to 3 years prison plus more than $5 million restitution for wire fraud and identity theft related to group activity involving breaches of more than 60 companies. French arrests occurred in June 2025 of individuals linked to ShinyHunters and related aliases. Matthew D. Lane of the United States was sentenced in 2025 in connection with a PowerSchool-related breach, with some reporting tying him to the broader ecosystem. In September 2026, Dutch police arrested a 24-year-old Amsterdam man identified in reporting as Pepijn van der Stap, previously known as "Umbreon," on 15 September on suspicion of a role in ShinyHunters and membership in a criminal organization. Devices were seized. He was also investigated for alleged solicitation of two murders unrelated to the cyber activity per police. A court ordered continued detention. The FBI described him as an alleged leader, noted the group's scale, and publicly urged remaining members to contact authorities. The group denied association in some statements. Further arrests were not ruled out. Operations have continued through arrests, consistent with the decentralized structure. In September 2026, ShinyHunters claimed to have compromised the Clop or Cl0p ransomware group's leak-site infrastructure via a Grav CMS vulnerability, defaced it, and demanded payment and an apology, framing it as retaliation for prior threats. Clop responded seeking contact. --- FBI CONTACT INFORMATION Federal Bureau of Investigation J. Edgar Hoover Building 935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001 Telephone: (202) 324-3000 Website: www.fbi.gov FBI Director: Christopher Wray FBI Cyber Division Telephone: (202) 324-3000 FBI Internet Crime Complaint Center (IC3) Website: www.ic3.gov