Threat Intelligence

CyrusOne Data Breach: ShinyHunters Leaks 373K Records After $13M Demand

In short

ShinyHunters named data center operator CyrusOne on August 23, 2026 and demanded $13 million.
Have I Been Pwned has loaded 373,460 email addresses from the data later published, with names, job titles, phone numbers and support tickets.
CyrusOne has not commented publicly; the claims about contracts, floor plans and credential files are unverified.
Most small businesses are not affected; CyrusOne customers should verify any message about tickets or maintenance.

CyrusOne, which runs some 50 data centers across the United States for customers that include Microsoft, Meta and other large companies, is the target of a ShinyHunters “pay or leak” extortion campaign. The group put an unnamed victim on its leak site on August 20, 2026, named CyrusOne on August 23 and demanded $13 million. It claims to hold 12.9 million Salesforce records, more than 600 GB of SharePoint files, employee records, contracts, data center floor plans and access-control files. CyrusOne has not commented publicly. Data allegedly from the company was later published, and Have I Been Pwned has loaded 373,460 unique email addresses from it, dating the breach to August 5, 2026. The listing is on our CyrusOne data breach page.

What was exposed

The breach catalogue lists names, email addresses, employers, job titles, phone numbers, physical addresses and support tickets, covering users, sales leads and CyrusOne employees. It does not list passwords. The larger claims about contracts, floor plans and credential files come only from the attackers and have not been verified.

Support tickets are the detail to watch. They tell an attacker which customers had which open issues, so a fake message about “your ticket” or a scheduled maintenance window can look exactly like the real thing. Names, titles and phone numbers make the same story work over a phone call.

Does this touch your business?

If your company rents space or services from CyrusOne, has opened a support ticket with them, or someone on your team asked them for a quote, your contact details may be in this dataset. Most small businesses have never dealt with CyrusOne directly and are unlikely to be in it.

The indirect risk is to anyone who works with CyrusOne customers: details about who uses which facility and service are useful for tailored phishing well beyond CyrusOne itself.

Related to this campaign: the ShinyHunters extortion of Neogen and Sysco.

What to do this week

Check your team’s addresses. Run your work addresses through our free Am I Breached? checker, which uses the same Have I Been Pwned data, and turn on alerts for the next breach.
If you are a CyrusOne customer, treat ticket and maintenance messages with suspicion. Confirm anything about a ticket, an outage or an account change through the customer portal or a contact you already have, not the details in the message.
Precaution for portal accounts. The catalogue lists no passwords, but the group claims to have taken credential files. If your team uses a CyrusOne portal account, changing that password and turning on multi-factor authentication is cheap insurance.
Warn the people who handle vendors. IT and office staff should expect calls and emails that mention CyrusOne or data center services and should verify before acting.

Frequently asked questions

Did CyrusOne confirm the breach?

No. As of October 12, 2026, CyrusOne had not commented publicly on the ShinyHunters claims.

Were passwords exposed?

The breach catalogue lists no passwords. The attackers say they took credential and access-control files, which has not been verified, so changing CyrusOne portal passwords and turning on multi-factor authentication is a sensible precaution.

How do I know if my email is in the CyrusOne data?

Enter it in our free Am I Breached? checker, which uses the Have I Been Pwned data, and turn on alerts.

Is this part of a larger campaign?

Yes. The same ShinyHunters “pay or leak” pressure hit Neogen and Sysco this year, and in each case the data published was mostly corporate contact records.

Data from Have I Been Pwned | Sources: Cybernews, TechRadar | Written with AI assistance and checked against these sources on October 12, 2026

Found this useful? The next one can come to you.

We write now and then: practical security for a small business, the month's ransomware figures in plain language, and new free tools when they land. No spam, and one click to leave.

A tool by Digital Checkmark