ShinyHunters has added Metabase to its leak site, publishing what it claims is a 7.1 GB compressed archive available for immediate download. Unlike the group’s typical posts, the listing did not include a ransom countdown, negotiation period, or any description of the allegedly stolen data.
The listing consists only of the company name, a single line containing :P, and a download button pointing to an archive identified as metabase.tar.xz. The archive is listed at 7.1 GB in compressed form and was updated on August 11, 2026.
Posted without a countdown
ShinyHunters typically publishes victims to its leak site with a countdown timer before releasing data publicly, giving organizations an opportunity to negotiate before files become available. In this case, no countdown appeared.
Instead, the alleged Metabase archive was immediately listed as downloadable, suggesting the group skipped its usual publication workflow. No explanation accompanied the release, and no ransom note or victim statement was included.
Contents remain unknown
The leak page does not describe what the archive allegedly contains. There are no file listings, record counts, sample documents, or screenshots of the purported data.
Because no sample has been provided and the archive has not been independently analyzed, it is currently unknown whether the download contains source code, databases, internal documents, customer information, employee records, or other material.
Metabase had not issued any public statement at time of publication.
New download hub appears on leak site
The publication also coincides with what appears to be a centralized download hub on the ShinyHunters leak site. The page lists previously published victims alongside downloadable archives, including the newly added metabase.tar.xz entry.
BreachNews has been tracking ShinyHunters’ recent activity in its ShinyHunters threat actor profile, where additional campaigns and victim disclosures are documented.
As with all unverified breach claims, the existence of a listing on a leak site alone does not confirm the authenticity or scope of the alleged data. BreachNews will update this article if Metabase confirms the incident or additional evidence regarding the archive becomes available.
