ShinyHunters 'pay or leak' extortion of CyrusOne leaks 373k contact records, added to Have I Been Pwned
In August 2026, data centre operator CyrusOne was targeted in a ShinyHunters "pay or leak" extortion attempt. The group later published data allegedly stolen from the company, covering about 373k unique email addresses across records for users, sales leads and CyrusOne employees. The data is mostly corporate contact information, and also includes support tickets and other operational information. Have I Been Pwned added the dataset on 7 Oct 2026, with 373.5k affected addresses.
Technical Details
- Extortion model: "pay or leak" by ShinyHunters, with the data published after the attempt.
- Exposed data: email addresses, names, physical addresses, phone numbers, job titles, support tickets and other operational information.
- The breach occurred in August 2026. The article does not state the initial access vector, and CyrusOne has not confirmed the breach in the article.
Remediation
- Affected individuals should use a password manager to set strong, unique passwords, change any affected password and enable 2FA wherever it is supported.
- Because the exposed data is business contact information, recipients should expect targeted phishing and social engineering that uses the leaked details.
Linha do tempo
-
ShinyHunters 'pay or leak' extortion of CyrusOne leaks 373k contact records, added to Have I Been Pwned
ler a análise desta fonte ocultar
In August 2026, data centre operator CyrusOne was targeted in a ShinyHunters "pay or leak" extortion attempt. The group later published data allegedly stolen from the company, covering about 373k unique email addresses across records for users, sales leads and CyrusOne employees. The data is mostly corporate contact information, and also includes support tickets and other operational information. Have I Been Pwned added the dataset on 7 Oct 2026, with 373.5k affected addresses.
Technical Details
- Extortion model: "pay or leak" by ShinyHunters, with the data published after the attempt.
- Exposed data: email addresses, names, physical addresses, phone numbers, job titles, support tickets and other operational information.
- The breach occurred in August 2026. The article does not state the initial access vector, and CyrusOne has not confirmed the breach in the article.
Remediation
- Affected individuals should use a password manager to set strong, unique passwords, change any affected password and enable 2FA wherever it is supported.
- Because the exposed data is business contact information, recipients should expect targeted phishing and social engineering that uses the leaked details.