ShinyHunters in 2026: 49 Companies, 145 Million Accounts and One Phone Call

Since February 2026, Have I Been Pwned (HIBP), the breach database behind our Am I Breached? checker, has loaded 49 datasets published by the ShinyHunters extortion group, with 144,724,627 accounts in total. The pattern repeats: the group takes data, names the company with a “pay or leak” ultimatum, and publishes the files when the company does not pay. We have covered several in detail: Sysco, McKesson, CyrusOne and Neogen. The two most recent before those were Questel, the French intellectual property software company (1.2 million addresses from sales leads, support cases and marketing), and Medela, the Swiss breast pump and medical device maker (424,000 addresses, mostly healthcare professionals, staff and sales leads).

How they get in: a phone call

Google Threat Intelligence described the playbook in 2025: callers pose as the company’s IT support, persuade an employee to approve a “connected app” in the company’s Salesforce, then use that access to export the data. Months later, a group using the ShinyHunters name runs the extortion. In 10 of the 49 HIBP entries the description mentions Salesforce, and HIBP notes in the Kemper case that access came through social engineering. No exploit, no malware: just a convincing call and one approval. We wrote about why attackers now call instead of email.

What gets published

Every one of the 49 datasets has email addresses. 47 have names, 44 phone numbers and 43 physical addresses. 20 include job titles, 16 employers and 10 support tickets, which is what CRM and helpdesk data looks like. Some go further: 13 include dates of birth and 4 government ID numbers, and Exact Sciences, McKesson and DentaQuest include health information.

Does this touch your business?

Two ways. First, if you or your staff are customers, suppliers or sales leads of any company in the list below, your work contact details are probably in one of these files. That makes you a better target for phishing: a message that knows your name, employer and job title is easy to believe.

Second, the method works on any company with a CRM or a Microsoft 365 tenant, not only on large brands. If an employee can be talked into approving an app or reading out a code, your customer list is reachable too.

What to do this week

• Check your addresses. Run your work addresses through Am I Breached?, which uses the same HIBP data, and turn on alerts.
• Make one rule for phone requests. Real IT support never asks you by phone to approve an app, accept a login prompt or read out a code. Hang up and call back on a number you already have.
• Lock down connected apps. In Salesforce, HubSpot or Microsoft 365, require an administrator to approve new third-party apps, and review the ones already connected.
• Limit who can export everything. Few people need to download the whole customer list. Remove bulk export from accounts that do not need it.

The 49 companies, newest first

Each name links to its breach page with the full list of exposed data.

Data from Have I Been Pwned as of October 12, 2026 | Sources: Google Threat Intelligence on UNC6040 | Written with AI assistance and checked against these sources on October 12, 2026

Related

• Am I Breached? Check an address and get alerts
• Data breach directory