Loading story…
Eye care company Alcon was listed in a ShinyHunters "pay or leak" extortion campaign after the threat actor allegedly exfiltrated company data and later published it. According to breach reporting, the leaked dataset contains about 218,000 unique email addresses tied largely to business contacts rather than consumer accounts.
The exposed information reportedly consists mostly of corporate B2B contact data, including names, phone numbers, physical addresses, and email addresses. Public breach tracking indicates the data was released after Alcon was targeted for extortion and the demanded payment was either refused or not made, making the incident part of a broader pattern of data-theft-led leak operations by ShinyHunters.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned published a breach notice about Alcon identifying the incident as a confirmed data breach notification. The notice described ShinyHunters as the threat actor and summarized the exposed data types and scale.
In August 2026, eye care company Alcon was named in a ShinyHunters "pay or leak" extortion campaign. The threat actor was identified as attempting to coerce payment by threatening to publish stolen data.
ShinyHunters subsequently published data it claimed was sourced from Alcon after payment was refused or not made. The leaked dataset allegedly contained 218,000 unique email addresses plus names, phone numbers, physical addresses, and mostly corporate B2B contact information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Inter-Con Security was reportedly targeted in a **ShinyHunters** "pay or leak" extortion campaign, and data the threat actor claimed to have stolen was later published online. The exposed dataset allegedly contained about **276,000 unique email addresses** and roughly **276,114 total records**, affecting a mix of contacts, internal users, and sales leads tied to the company. The leaked information reportedly included names, physical addresses, job titles, phone numbers, employer details, and email addresses. The breadth of the exposed personal and business contact data raises immediate risks of targeted phishing, identity theft, impersonation, and other follow-on social engineering attacks, while no specific remediation details from Inter-Con Security were cited in the reporting.
Aug 8, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
ShinyHunters has published a broad trove of allegedly stolen data affecting more than 40 organizations across retail, healthcare, hospitality, insurance, and consumer services, with reporting tying the leak campaign to victims including **Bumble**, **Match Group**, **Mytheresa**, **Zara**, **Carnival**, and **7-Eleven**. Researchers said the exposed material includes personally identifiable information, customer and transaction records, internal corporate files, and multi-terabyte datasets; one of the largest alleged exposures involved **Medtronic**, where roughly **9 million records** were reportedly listed before that entry was later removed from the leak site. The campaign reflects ShinyHunters' continued shift from ransomware-style encryption to **data theft and extortion**, with the group allegedly threatening to keep victim data available indefinitely on criminal platforms. Separate reports said the actors claimed to have stolen about **10 million records** from dating-app companies, while researchers also linked leaked **Bumble** data to the same operation after an earlier claim that roughly **30GB** had been taken from the company. The disclosures echo a wider criminal pattern in which stolen sensitive data is leaked to pressure victims after exfiltration, including in healthcare breaches such as the Change Healthcare incident.
Jun 29, 2026