Skip to content
Leak-site post naming Jinny Beauty Supply, captured by ThreatCluster

Jinny Beauty Supply

aurora

Ransomware leak-site victim intelligence · EN

Data size
3.6 GB
Files
7
Views
13,237
Posted
Sep 7, 2026
Country
United States
Industry
Wholesale beauty distribution

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reporting

Aurora claims Jinny Beauty Supply, a US wholesale beauty distributor, had 3.6 GB of data exfiltrated across seven files. The data categories claimed include HR records, personal data, payment card data, financial data, tax documents and credentials/access data. The leak page shows a data-publishing countdown of 10 days, 2 hours, 26 minutes, 45 seconds and lists the publication status as listed.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0
Domains
jinny.com
Platforms
PayPal Braintree Amazon Seller Central eBay Acumatica ERP FedEx UPS ShipStation Microsoft 365 Google Analytics VMware vCenter VMware ESXi Active Directory DPAPI RDP

What was taken

Jinny Beauty Supply is one of the largest Korean-American wholesale beauty distributors in the US, operating 9 distribution centers from Doraville, Georgia to Commerce, California. They serve 7,400+ beauty supply stores and 2,800+ international distributors.

Data categories
Credentials / passwordsPayment card dataEmployee compensation dataShopify customer dataActive Directory / identity dataTax documentsDatabase backups
Leak site tags
distributorsemployee datapassword vaultVMware credentialscredit card dataShopify databaseActive DirectoryW-4 formsI-9 formsSQL backups
File types seen
txt × 4json × 1xlsx × 2
Sample files (7)
Shopify Customer Data.xlsx
dsusers.txt
Copy of Salary-2022-Feb.xlsx
appsettings.json
KeyToken.txt
eqllogic.txt
Cam PW.txt

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Phone
+1 800 936 8733
Social
Instagram (https://www.instagram.com/jinnyknowsbeauty) Facebook (https://www.facebook.com/jinnybeautysupply/) LinkedIn (https://www.linkedin.com/company/jinny-corporation/) YouTube (https://www.youtube.com/user/jinnyvideos)
Address
3587 Oakcliff Road Doraville, GA 30340
Data Publishing
Published 2026-09-19

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring the text "JINNY CORP" with a stylized letter "J" in a blue circular design.
onion leak page9.3 KB