Names data breaches

Sharecare, a digital health company, had data on approximately 318,000 accounts published by the ShinyHunters group following an extortion campaign in August 2026.

Neogen, a food and animal safety organization, had data on approximately 436,000 individuals published by the ShinyHunters group following an extortion attempt in August 2026.

Data centre operator CyrusOne had data on approximately 373,000 accounts published by the ShinyHunters group following an extortion attempt in August 2026.

Double Counter, a Discord server protection service, suffered a data breach in October 2026 affecting approximately 275,000 accounts, exposing email addresses, Discord usernames, and limited subscriber details.

Angel One, an Indian stock brokerage firm, confirmed in July 2024 that a breach from April 2023 exposed personal and financial data for approximately 6.8 million unique users.

RingCentral, a cloud-based business communications platform, had data on approximately 1.6 million accounts exposed after a ShinyHunters extortion campaign in July 2026.

Questel, a French intellectual property software and services company, had data on approximately 1.2 million accounts published by the ShinyHunters group following an extortion campaign in August 2026.

Australian beauty retailer Oz Hair and Beauty had data on approximately 2 million customers exposed after an extortion attack by the group xpl0itrs in August 2026.

Manchester Airports Group disclosed a breach in August 2026 in which the FulcrumSec hacking group stole and published data on approximately 8.8 million customers of Manchester, Stansted, and East Midlands airports.

Inter-Con Security had data on approximately 276,000 individuals published by the ShinyHunters group following an extortion campaign in June 2026.

Golf Canada had approximately 569,000 user records allegedly exposed in mid-2026, with the data later circulating on Telegram.

In August 2026, unauthorized access to the Fanlore wiki exposed approximately 145,000 accounts including email addresses, usernames, names, and hashed passwords.

In August 2026, approximately 4.6 million unique Chess.com user records including names, usernames, email addresses, and geographic locations were posted online, with analysis suggesting the data was obtained through scraping.

Clothing retailer Carhartt had data on approximately 12.9 million customers exposed after the ShinyHunters group conducted an extortion campaign and published stolen records in August 2026.

Burger King Russia suffered a data breach in August 2024 affecting approximately 3.2 million customers, exposing personal details including names, email addresses, phone numbers, and dates of birth.

Brinks Home suffered a data breach in July 2026 in which the ShinyHunters group published data on approximately 732,000 customers, leads, and staff, including names, contact details, and partial credit card information.

Alcon, an eye care company, had data on approximately 218,000 individuals published by the ShinyHunters group in August 2026 following an extortion campaign.

Houston City College suffered a data breach in June 2026 when ShinyHunters extorted the college and later published data on approximately 832,000 current students and alumni.

Hackers obtained and publicly released data from gig economy platform Paidwork in March 2026, exposing over 23 million accounts including banking information, passwords, and broad personal profile data.

A November 2025 Suno security incident was followed by reports of a dataset containing more than 55 million unique email addresses and a smaller set of purchase records.

Fluke Corporation had data on over 821,000 accounts exposed after the ShinyHunters group published more than 100GB of allegedly stolen data in July 2026.

Goose Creek Candle Company suffered a data breach in June 2026 that exposed the personal and purchase information of approximately 6.6 million customers.

Glendale Community College suffered a data breach in June 2026 affecting nearly 794,000 individuals, exposing names, email addresses, Social Security numbers, and student enrollment records.

Moody Bible Institute suffered a data breach in June 2026 in which over 2.3 million accounts had personal information including names, addresses, phone numbers, and dates of birth publicly exposed following a ShinyHunters extortion campaign.

Sysco, a food distribution company, had data on approximately 2.7 million staff and customers exposed after a ShinyHunters extortion campaign resulted in the publication of corporate contact information.

American Tower had data on over 216,000 employees, contractors, customers, and leads exposed after a ShinyHunters extortion campaign in June 2026.

Madison Square Garden Sports had data on nearly 10 million accounts exposed after the ShinyHunters group carried out a pay-or-leak extortion campaign and published the stolen data online.

JCPenney suffered a data breach in June 2026 when ShinyHunters exploited a zero-day vulnerability in Oracle PeopleSoft, exposing personal and HR data for approximately 368,000 current and former employees.

Ralph Lauren had data on approximately 140,000 individuals exposed after the ShinyHunters group claimed to have extracted records from the company's Salesforce instance and published them as part of an extortion campaign.

CFGI, a financial consulting and advisory firm, had data on approximately 248,000 individuals exposed after the ShinyHunters group conducted an extortion campaign and subsequently published corporate contact information.

Infinite Campus, a student information system, had data on approximately 137,000 accounts stolen and published by the ShinyHunters group in March 2026 following an extortion campaign.

Berkadia, a commercial real estate finance company, had data from its Salesforce instance published by the ShinyHunters group in March 2026, exposing over 300,000 individuals' contact and employer information.

Baker Distributing Company had data on approximately 103,000 accounts exposed after the ShinyHunters extortion group published information allegedly taken from the company's SharePoint and Salesforce systems in May 2026.

BCD Travel, a corporate travel management company, had data on approximately 396,000 individuals exposed after ShinyHunters claimed the company as a victim of an extortion campaign and published the data publicly in early June 2026.

DentaQuest, a dental benefits administrator, had data on approximately 2.6 million individuals publicly leaked by the ShinyHunters group following an extortion campaign in May 2026.

Charter Communications had data on approximately 4.9 million accounts exposed after the ShinyHunters group threatened extortion and subsequently published the stolen data.

Kemper Corporation had data on approximately 269,000 individuals exposed after the ShinyHunters ransomware group accessed its Salesforce environment via social engineering and published the stolen data in an extortion campaign.

Mytheresa, a luxury fashion e-commerce platform, had data on approximately 84,000 customers exposed after the ShinyHunters extortion group published it following a failed ransom demand in April 2026.

Ameriprise Financial had data from approximately 500,000 accounts exposed after the ShinyHunters group exfiltrated over 200GB from its Salesforce and SharePoint systems and published it following failed extortion negotiations.

Colombian fintech company Addi suffered a breach in March 2026 affecting over 34 million accounts, exposing financial, identity, and credit-related personal data after the ShinyHunters group claimed responsibility and published the stolen data.

7-Eleven suffered a data breach in April 2026 when the ShinyHunters group conducted an extortion campaign and later published data on approximately 185,000 individuals.

Dragonica Lunaris, a European private game server, suffered a data breach in December 2025 that exposed account data for approximately 126,000 users.

In April 2026, data allegedly taken from CTT, Portugal's national postal service, was posted to a public hacking forum, affecting approximately 468,000 accounts.

Abrigo, a fintech software company, had data from its Salesforce instance published by the ShinyHunters group in April 2026, exposing business contact information for over 711,000 individuals.

Canada Life suffered a data breach in April 2026 when the ShinyHunters group stole and published data on over 237,000 customers, including names, email addresses, phone numbers, physical addresses, and support tickets.

In May 2026, real estate services firm Cushman & Wakefield had data on approximately 310,000 accounts exposed after the ShinyHunters group carried out an extortion campaign and published stolen corporate contact records.

Woflow, an AI-driven merchant data platform, had data on approximately 447,593 accounts exposed after the ShinyHunters extortion group published files allegedly stolen from the company in March 2026.

LegionProxy, a commercial residential and ISP proxy network, suffered a data breach in April 2026 that exposed approximately 10,000 accounts including email addresses, names, bcrypt password hashes, and purchase records.

In April 2026, the ShinyHunters extortion group published data from a third-party analytics vendor breach affecting approximately 119,000 Vimeo user email addresses and names.

Marcus & Millichap, a commercial real estate brokerage, had data on approximately 1.8 million individuals exposed after being named as an alleged victim of the ShinyHunters hacking group in April 2026.

ZenBusiness, a business formation platform, had data on approximately 5.1 million accounts exposed after the hacker group ShinyHunters claimed to have exfiltrated records from multiple platforms and publicly released the data following an unpaid ransom demand.

Aman, an ultra-luxury hotel brand, suffered a data breach in April 2026 when ShinyHunters obtained customer records from their Salesforce CRM and later leaked them publicly.

Udemy suffered a data breach affecting 1.4 million accounts, with customer and instructor information including email addresses, names, addresses, phone numbers, and payment methods exposed.

SUCCESS, a personal development media brand, suffered a data breach in March 2026 exposing approximately 253,510 accounts with names, email addresses, phone numbers, and other personal information.

Sound Radix disclosed a data breach in March 2026 affecting approximately 293,000 user accounts.

SongTrivia2, a music trivia platform, suffered a data breach in April 2026 affecting approximately 292,000 accounts, with data subsequently published to a public hacking forum.

Pitney Bowes suffered a data breach in April 2026 affecting approximately 8.2 million individuals, with ShinyHunters claiming responsibility and publicly releasing the stolen data.

McGraw Hill confirmed a data breach in April 2026 affecting 13.5 million accounts, exposing email addresses, names, phone numbers, and physical addresses due to a Salesforce misconfiguration.

Hallmark suffered a breach in March 2026 after attackers accessed data stored in Salesforce, exposing approximately 1.7 million customer records.

Crunchyroll suffered a data breach in March 2026 affecting approximately 1.2 million email addresses, with additional personal information exposed from the company's Zendesk support system.

Carnival Corporation suffered a data breach affecting 7.5 million records from its Holland America loyalty program after ShinyHunters claimed to obtain and later published the data.

Turkish restaurant chain Baydöner suffered a data breach in March 2026 exposing over 1.2 million customer records including names, email addresses, phone numbers, and plaintext passwords.

Aura disclosed a data breach in March 2026 affecting over 900,000 customer records, primarily from a marketing tool associated with a previously acquired company.

Amtrak suffered a data breach in April 2026 affecting over 2.1 million accounts, with the hacking group ShinyHunters claiming responsibility and later publishing the stolen data.

ADT confirmed a data breach affecting 5.5 million customers in April 2026, with ShinyHunters claiming responsibility and threatening to leak the data.

A November 2025 breach of Beckett Collectibles reportedly exposed account and contact information associated with approximately one million email addresses.