Loading story…
Eastman Kodak confirmed it is investigating a cybersecurity breach after an unauthorized third party briefly accessed a limited amount of company data. The company said it has engaged external cybersecurity experts and is coordinating with law enforcement, while maintaining that there is no threat to its systems or ongoing operations and that no operational disruption has been reported.
The confirmation followed claims by the ShinyHunters extortion group, which said it stole more than 2.2 million records containing customer PII and internal corporate data. Kodak has not verified the full scope of those claims, has not disclosed what categories of customer information may have been affected, and no proof samples had been published, but the group threatened to leak the allegedly exfiltrated data and potentially carry out additional disruptive activity if the company did not respond by June 18, 2026.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
ShinyHunters threatened to leak the allegedly exfiltrated Kodak data and potentially carry out additional disruptive activity if Kodak did not respond. The deadline cited in the reporting was June 18, 2026.
Kodak confirmed that an unauthorized third party briefly accessed a limited amount of company data and said it is investigating the incident. The company stated it engaged external cybersecurity experts, is working with law enforcement, and is confident there is no threat to its systems or operations.
ShinyHunters claimed on its leak site that it had stolen more than 2.2 million Kodak records containing customer PII and internal corporate data. The group did not publish proof samples, according to the reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecurityweek.com
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesecuritymagazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ADT disclosed that attackers gained unauthorized access to certain cloud-based environments and stole customer and prospective customer data, prompting the company to activate incident response measures, engage forensic specialists, notify law enforcement, and contact affected individuals. The exposed information included names, phone numbers, and home addresses, with dates of birth and the last four digits of Social Security numbers or Tax IDs affected in a smaller number of cases; ADT said payment information was not accessed and customer home security systems were not impacted. The disclosure followed claims by the **ShinyHunters** extortion group that it had stolen more than 10 million records and internal corporate data and would leak the information if its demands were not met. Reporting tied the intrusion to a suspected vishing attack that allegedly compromised an employee's **Okta** single sign-on account and enabled access to ADT's **Salesforce** environment, matching a broader pattern in which the group targets enterprise SSO accounts and connected SaaS platforms to steal data for extortion.
Aug 4, 2026
**Ernst & Young (EY)** is facing a claimed extortion campaign from **ShinyHunters**, which says it stole employee credentials and sensitive files and has threatened to leak the data unless the firm makes contact by **July 31**. A posting attributed to the group warned of both public data exposure and additional digital disruption, while identifying `ey.com` as the affected domain. The claim follows EY's earlier disclosure that attackers gained unauthorized access to a third-party IT service management platform between **March 28 and April 12, 2026**, with anomalous activity detected on **April 23**. EY said documents linked to numerous tax clients were downloaded from support tickets containing tax records and personal and financial data, including names, addresses, Social Security numbers, and payment card details. The firm notified regulators in California and Texas, said at least **1,366** residents across multiple U.S. states were affected, and offered two years of credit monitoring and identity restoration; EY has not confirmed ShinyHunters' involvement, and no leaked data had been observed on underground forums at the time of reporting.
Jul 29, 2026
**Figure Technology Solutions**, a blockchain-based lending/fintech firm, confirmed a **data breach** after an employee was **socially engineered**, enabling attackers to access and exfiltrate a **limited number of files**. The company said it is communicating with partners and impacted individuals, has begun sending notifications, and is offering **free credit monitoring** to recipients of breach notices; it has not publicly disclosed the total number of affected individuals or when the incident was detected. The cybercrime group **ShinyHunters** claimed responsibility and alleged Figure refused to pay a ransom, publishing about **2.5GB** of purportedly stolen data on its leak site. Journalists who reviewed samples reported the exposed data included **names, home addresses, dates of birth, and phone numbers**, increasing risk of identity fraud and follow-on phishing. ShinyHunters also told reporters the intrusion was part of a broader campaign affecting organizations including **Harvard University** and **UPenn**, and referenced victims that rely on **Okta** for single sign-on.
Jun 29, 2026