In short
- On August 29, 2026, ShinyHunters claimed a breach of food and animal safety company Neogen and threatened to leak the data.
- Have I Been Pwned has loaded 435,963 email addresses from the data the group published, with names, employers, job titles and phone numbers.
- Neogen has not publicly confirmed the incident; no passwords or payment data are listed.
- The main risk is targeted phishing and phone scams that use real names and job titles.
On August 29, 2026, the extortion group ShinyHunters claimed it had breached Neogen, the US food and animal safety testing company, and threatened to leak the data unless Neogen paid. The group later published records it attributed to Neogen. Have I Been Pwned has loaded that dataset: 435,963 unique email addresses, mostly corporate contact records from mailing lists, employee records and other contacts. Neogen has not publicly confirmed the incident or its scope in any reporting we could find, so these figures describe what the group published, not a count confirmed by the company. The listing is on our Neogen data breach page.
What was exposed
The breach catalogue lists names, email addresses, employers, job titles, phone numbers, physical addresses and salutations. It does not list passwords, payment card numbers or government ID numbers. None of this gives anyone direct access to an account, but together it is exactly what a convincing scam needs.
An email that uses your real name, your employer and your job title does not look like spam. It looks like a business partner. Phone numbers extend the same trick to calls and text messages: a caller who knows your name and role sounds like someone who has worked with you before.
Does this touch your business?
Neogen sells food safety tests, animal health products and laboratory supplies. If your company buys from Neogen, works with them, or someone on your team is on one of their mailing lists, their work contact details may be in this dataset. If you have never dealt with Neogen, you are unlikely to be in it.
The indirect risk is that datasets like this get merged into larger directories of working professionals. If your staff appear in them, expect more targeted email and calls that use real names and titles.
Related to this campaign: the ShinyHunters extortion of CyrusOne and Sysco.
What to do this week
- Check your team’s addresses. Run your work addresses through our free Am I Breached? checker, which uses the same Have I Been Pwned data, and turn on alerts for the next breach.
- Confirm payment and contact changes by phone. Anyone in purchasing or accounting who receives a request to change bank details, delivery addresses or contacts should call the supplier back on a number already on file, never one from the message.
- Do not trust a caller because they know your name. If someone claims to represent a vendor or partner, take a message and call back through a known channel before sharing anything.
Frequently asked questions
Did Neogen confirm the breach?
Not in any public reporting we could find as of October 12, 2026. The figures describe the data ShinyHunters published.
Were passwords or payment details exposed?
No. The breach catalogue lists names, email addresses, employers, job titles, phone numbers, physical addresses and salutations, but no passwords, card numbers or government IDs.
How do I know if my email is in the Neogen data?
Enter it in our free Am I Breached? checker, which uses the Have I Been Pwned data, and turn on alerts.
Is this part of a larger campaign?
Yes. ShinyHunters ran the same “pay or leak” extortion against CyrusOne and Sysco this year.
Data from Have I Been Pwned | Sources: Cybernews | Written with AI assistance and checked against these sources on October 12, 2026
Related
- ShinyHunters in 2026: all 49 companies and how they get in
- Am I Breached? Check an address and get alerts
- Data breach directory