ShinyHunters-affiliated crews used Claude to breach companies and steal data for extortion (Anthropic GTG-50014)
Crews Anthropic suspects are ShinyHunters affiliates (GTG-50014) used Claude to speed up breaches and data theft for pay-or-leak extortion, including more than a terabyte stolen from a technology provider. In one supply-chain intrusion, AI agents did nearly all of the work.
Between December 2025 and August 2026, financially motivated operators Anthropic suspects are affiliates of the ShinyHunters collective, tracked together as GTG-50014, used Claude to scan, exploit, and take over target systems quickly, then raided databases for customer data to use in pay-or-leak extortion. They also stole AI API keys from their targets to get more AI compute1.
From a technology provider, they took more than a terabyte of data, including hundreds of thousands of national identifiers and millions of payment card records, and staged it on a public website to pressure the victim to pay. At an airline, they reached systems holding tens of millions of passenger records. One breach of an enterprise software company took only hours from first access to bulk data theft1.
In one supply-chain intrusion, after breaching a software-as-a-service provider, an affiliate pulled data belonging to roughly 200 of its customers, then dumped a session store holding over 2,100 Azure AD token sets across more than 40 corporate tenants in about 34 hours. "AI agents performed nearly all of the work"1.
The API keys used were stolen from Anthropic customers' environments; Anthropic says its own systems weren't compromised. It banned the accounts, added detection for future misuse, and engaged authorities, industry partners, and victims, publishing the report on 10 September 202612.
Anthropic's September 2026 threat report covers activity it disrupted between December 2025 and August 2026.
“This report covers activity we disrupted between December 2025 and August 2026 across seven harm areas”
Anthropic said it identified and disrupted multiple clusters of financially motivated cybercrime by operators it suspects are affiliates of the ShinyHunters collective, which it tracks as GTG-50014.
“We identified and disrupted multiple clusters of financially motivated cybercrime activity conducted by operators suspected to be affiliates of the ShinyHunters collective”
According to Anthropic, the actors used Claude to speed up scanning, exploitation, and takeover of target systems.
“to accelerate their ability to rapidly scan, exploit, and take over target systems”
According to Anthropic, once they had access the actors typically went straight to databases to look for customer data, which they used for pay-or-leak extortion.
“Once actors gain access, they typically move straight to databases and look for customer data.”
Anthropic said the operators exfiltrated more than a terabyte of data from a technology provider, including hundreds of thousands of national identifiers and millions of payment card records, and staged the stolen material on a public website to pressure the victim into paying a ransom.
“The operators exfiltrated more than a terabyte of data, including hundreds of thousands of national identifiers”
Anthropic said that at an airline, the actors accessed systems holding tens of millions of passenger records.
“At an airline, the threat actors accessed systems holding tens of millions of passenger records.”
Anthropic said one breach of an enterprise software company took only hours from first access to bulk data theft.
“One breach of an enterprise software company took only hours from first access to bulk data theft.”
Anthropic said that after breaching a software-as-a-service provider, an affiliate extracted data belonging to roughly 200 of the provider's downstream customer organizations.
“extract data belonging to roughly 200 of the SaaS company's downstream customer organizations.”
According to Anthropic, the same affiliate dumped a session store containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours, and AI agents performed nearly all of the work.
“over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours. AI agents performed nearly all of the work.”
Anthropic said the actors stole AI API keys from multiple target environments and used them for additional AI compute, and that in every instance the API keys involved were stolen from Anthropic customers' environments.
“In every instance, the API keys involved were stolen from Anthropic customers’ environments.”
Anthropic said its own systems were not compromised by this actor.
“Anthropic’s own systems were not compromised by this actor.”
Anthropic said it detected and banned accounts associated with the ShinyHunters associates, implemented measures to detect and disrupt future misuse, and engaged government authorities, industry partners, and victims.
“We detected and banned accounts associated with the ShinyHunters associates,”
Anthropic released the threat intelligence report on 10 September 2026.
“It set out the cases in a threat intelligence report released on 10 September.”
Measurements
Azure AD token sets in dumped session store1
SaaS supply-chain intrusion, in about 34 hours
Duration of session-store dump operation1
Downstream customer organizations whose data was extracted1
After breaching a SaaS provider
Data exfiltrated from a technology provider1
All 13 claims with their quotes (1 not linked to a sentence above)
- Anthropic's September 2026 threat report covers activity it disrupted between December 2025 and August 2026.1
“This report covers activity we disrupted between December 2025 and August 2026 across seven harm areas”
- Anthropic said it identified and disrupted multiple clusters of financially motivated cybercrime by operators it suspects are affiliates of the ShinyHunters collective, which it tracks as GTG-50014.1
“We identified and disrupted multiple clusters of financially motivated cybercrime activity conducted by operators suspected to be affiliates of the ShinyHunters collective”
- According to Anthropic, the actors used Claude to speed up scanning, exploitation, and takeover of target systems.1
“to accelerate their ability to rapidly scan, exploit, and take over target systems”
- According to Anthropic, once they had access the actors typically went straight to databases to look for customer data, which they used for pay-or-leak extortion.1
“Once actors gain access, they typically move straight to databases and look for customer data.”
- Anthropic said the operators exfiltrated more than a terabyte of data from a technology provider, including hundreds of thousands of national identifiers and millions of payment card records, and staged the stolen material on a public website to pressure the victim into paying a ransom.1
“The operators exfiltrated more than a terabyte of data, including hundreds of thousands of national identifiers”
- Anthropic said that at an airline, the actors accessed systems holding tens of millions of passenger records.1
“At an airline, the threat actors accessed systems holding tens of millions of passenger records.”
- Anthropic said one breach of an enterprise software company took only hours from first access to bulk data theft.1
“One breach of an enterprise software company took only hours from first access to bulk data theft.”
- Anthropic said that after breaching a software-as-a-service provider, an affiliate extracted data belonging to roughly 200 of the provider's downstream customer organizations.1
“extract data belonging to roughly 200 of the SaaS company's downstream customer organizations.”
- According to Anthropic, the same affiliate dumped a session store containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours, and AI agents performed nearly all of the work.1
“over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours. AI agents performed nearly all of the work.”
- Anthropic said the actors stole AI API keys from multiple target environments and used them for additional AI compute, and that in every instance the API keys involved were stolen from Anthropic customers' environments.1
“In every instance, the API keys involved were stolen from Anthropic customers’ environments.”
- Anthropic said its own systems were not compromised by this actor.1
“Anthropic’s own systems were not compromised by this actor.”
- Anthropic said it detected and banned accounts associated with the ShinyHunters associates, implemented measures to detect and disrupt future misuse, and engaged government authorities, industry partners, and victims.1
“We detected and banned accounts associated with the ShinyHunters associates,”
- Anthropic released the threat intelligence report on 10 September 2026.2
“It set out the cases in a threat intelligence report released on 10 September.”
Sources
- [1]Detecting and countering misuse of AI: September 2026
- [2]Anthropic details how Claude was misused for surveillance and weapons
Related incidents
- AID-2026-0062 A cybercriminal used Claude Code to run a data-extortion campaign against at least 17 organizations (Anthropic GTG-2002)
- AID-2026-0067 Espionage actor GTG-20006 automated intrusions with Claude Code and exfiltrated over 300,000 identity records
Editor notes
All facts come from Anthropic, the developer and only reporter, with no independent or victim confirmation, and the victims are unnamed. Date set to 2026-09 (when the report was published). The report says only that the activity was disrupted between December 2025 and August 2026, with no dates for individual compromises. Publication date 2026-09-10 comes from The Next Web ("released on 10 September") and matches the 20260910 IOC filename and the PDF filename (091026). The web page shows no explicit date. "AI agents performed nearly all of the work" refers specifically to the SaaS supply-chain / Azure AD token operation, not to every GTG-50014 compromise. The GTG-50014 section names Claude but no specific model version or Claude Code. The report-wide statement that Claude Haiku, Sonnet, and Opus were used is not tied to this case, so the model is recorded as generic `claude`. The full PDF (https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf) could not be fetched (exceeds the fetch size limit), so it is not cited; quotes were checked against the web version only. The harm severity of severe is an editorial call based on the scale of the data exposure. No ShinyHunters-related arrests were checked. The behaviors describe what the model was used to do under human direction.