Shinyhunters breaches Houston Community College System
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Shinyhunters ransomware gang claims to have exfiltrated hundreds of thousands of student records from Houston Community College System with final extortion deadline.
Houston Community College System (HCCS) has been compromised by the Shinyhunters ransomware gang, which claims to have exfiltrated a large volume of sensitive institutional and personal data. The stolen dataset includes hundreds of thousands of student records containing personally identifiable information (name, address, phone, email, date of birth, gender, ethnicity), enrollment and academic data (GPA, major, status), financial aid and bursar records including FAFSA documentation, class rosters with grades and contact information, over 344,000 international student documents including SEVIS I-20 forms, visa applications, passports, financial and tax documents, and approximately 14,000 student health and immunization records. The threat actor is conducting extortion under a final deadline of 18 June 2026, threatening public disclosure of the data and additional disruption. This represents a significant breach of a major public educational institution affecting current and historical students, with exposure of data suitable for identity fraud, financial exploitation, and targeted attack.
Mentioned in this report
Detection guidance
Rclone Used to Copy or Sync Data to Remote Cloud Storage
Detects rclone executing copy/sync/move operations, a common way to bulk-exfiltrate data to cloud storage in data-theft extortion intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Used to Copy or Sync Data to Remote Cloud Storage
description: Detects rclone running transfer sub-commands (copy, sync, move) often
combined with tuning flags used for bulk exfiltration to cloud storage. The source
report only describes the breach outcome (large-scale data theft and extortion),
so this rule covers the generic exfil-to-cloud-storage technique rather than a named
tool from the report.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rclone.exe
- OriginalFileName: rclone.exe
selection_cmd:
CommandLine|contains:
- ' copy '
- ' sync '
- ' move '
- ' copyto '
selection_flags:
CommandLine|contains:
- --transfers
- --multi-thread-streams
- --ignore-existing
- --max-age
- --no-check-certificate
- --config
condition: selection_img and selection_cmd and selection_flags
falsepositives:
- Administrators using rclone for sanctioned backups or data migrations to cloud storage
- Developers syncing build artefacts with rclone on engineering workstations
level: medium
id: 2216d408-fd44-506a-a912-b1030fc2e909
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/aGNjcy5lZHVAc2hpbnlodW50ZXJz
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/aGNjcy5lZHVAc2hpbnlodW50ZXJz
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs