RANSOMWARE VICTIMHEALTHCARE

Amazon owned OneMedical.com

shinyhunters📍 United States (US)📅 June 18, 2026

linked CVEs

same group

Attack Intelligence

Amazon owned OneMedical.com was compromised in a ransomware attack attributed to shinyhunters in June 2026. The organization, operating in the Healthcare sector in United States, was added to the group's data leak site as part of an extortion campaign.

shinyhunters operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Over 8.8TB of data was compromised. This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 18 June 2026 | Warning: FINAL WARNING PAY OR LEAK

Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2026-35273, which may have been leveraged as initial access vectors or for lateral movement.

Additional Details

Correlated Vulnerabilities (1)

CVE-2026-35273CRITICALCVSS 9.8⚠ KEV

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Other Victims — shinyhunters (8)

US · Professional Services

Jul 2026

BH Security, LLC. (brinkshome.com)

US · Professional Services

Abbott owned Exact Sciences Corporation

US · Healthcare

Jul 2026

Quick Facts

CountryUnited States (US)

SectorHealthcare

Attack DateJun 18, 2026

Intel Sourceransomware.live

Threat Group

shinyhunters

Motivation: financial

View group profile →

External Links

Leak Site → Google (news) Search CTI.watch

Data sourced from Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Victim listing does not imply confirmed breach — intelligence based on group claims.

← All Victims·Threat Actors·Vulnerabilities