Rival cybercrime group ShinyHunters hijacked Clop’s dark-web leak site and demanded an eight-figure payment, turning the extortionist into a victim. The incident matters because ShinyHunters claims it accessed Clop’s wider infrastructure and may expose companies that paid ransoms, potentially causing further reputational and operational damage.

ShinyHunters says the dispute stems from Clop’s exploitation of an Oracle E-Business Suite vulnerability, which it claims to have discovered first. It has threatened to increase its demands every 24 hours and publish alleged ransom payments, although Clop has not responded and the wider access claims remain unverified. Clop is associated with major campaigns including the 2023 MOVEit attacks, while ShinyHunters has also been linked to large-scale data theft and extortion.