Loading story…
ShinyHunters allegedly gained access to Spectrum/Charter Communications' Salesforce environment by vishing an employee and compromising the employee's Microsoft Entra account. The actors reportedly used legitimate SSO access and native Salesforce capabilities to export customer data at scale, without exploiting a software vulnerability, deploying malware, or escalating privileges. Charter disclosed the incident on May 26, 2025, and said sensitive personal information and customer proprietary network information (CPNI) were not taken; ShinyHunters disputed that assertion and began releasing purported data samples the following day.
The intrusion reflects the social-engineering and identity-centric tradecraft associated with the Scattered LAPSUS$ Hunters ecosystem, an alliance linked to Scattered Spider, LAPSUS$, and ShinyHunters activity. Organizations using Entra and Salesforce should prioritize resistant help-desk identity-verification processes, Conditional Access, monitoring of Entra sign-ins and Salesforce activity, behavioral detection, and controls that restrict anomalous or bulk data exports.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a public warning urging organizations to verify urgent or unusual requests through an alternative communications channel, a precaution relevant to the voice-phishing tactics described in the Charter incident.
Have I Been Pwned added the Charter incident to its breach database and confirmed exposure of email addresses, customer names, and an employee directory containing roughly 85,000 records.
After Charter did not enter negotiations following the group's ultimatum, ShinyHunters began publishing samples of allegedly stolen data. The group disputed Charter's assertion that no CPNI was taken, releasing screenshots it characterized as CPNI.
After Charter appeared on ShinyHunters' leak site, Charter publicly confirmed the incident. The company said sensitive personal information and Customer Proprietary Network Information (CPNI) had not been stolen.
ShinyHunters allegedly used voice phishing to obtain a Charter employee's Microsoft Entra credentials, then used legitimate SSO access to enter Spectrum/Charter Salesforce and bulk-export customer records. The described intrusion did not involve exploitation of a vulnerability, malware deployment, privilege escalation, or lateral movement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcesosransomware.com
Open sourcepushsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Charter Communications confirmed a data breach after **ShinyHunters** threatened to leak allegedly stolen data, with the group claiming it accessed the company on April 1 through a voice-phishing attack that compromised an employee's Microsoft Entra account and opened a path into Charter's Salesforce environment. The attackers said they stole **40 million customer records**, including names, contact details, plan information, support ticket data, and some customer proprietary network information, while Charter said it notified authorities and, based on the data published, no sensitive personal information or CPNI was exfiltrated. The Charter incident follows a broader ShinyHunters extortion campaign targeting enterprise single sign-on accounts and connected SaaS platforms, especially **Salesforce**. In a separate case, the group claimed it stole several terabytes of data from **ZenBusiness** via platforms including Salesforce, Snowflake, and Mixpanel, and threatened to publish the data unless the company responded. Reporting also linked the campaign to claims involving Ameriprise Financial, Infinite Campus, Bumble, Hinge, Match, OkCupid, Mercer Advisors, Beacon Pointe Advisors, and attacks affecting Instructure's Canvas platform, underscoring a repeatable pattern of social engineering, SaaS data theft, and leak-site extortion.
Jun 29, 2026
**ShinyHunters** has been linked to a wave of SaaS-focused data-theft and extortion activity enabled by targeted **voice phishing (vishing)** and company-branded phishing portals designed to capture **SSO credentials** and **MFA codes**. Mandiant reported that attackers impersonate IT/helpdesk staff, direct employees to realistic login pages, and use real-time interaction (including guiding victims to approve push prompts or provide one-time codes) to authenticate and then **enroll attacker-controlled devices into MFA**. After account takeover, the actor pivots through **Okta, Microsoft Entra, or Google** SSO dashboards to rapidly access downstream SaaS services (e.g., *Salesforce*, *Microsoft 365/SharePoint*, *DocuSign*, *Slack*, *Atlassian*, *Dropbox*, *Google Drive*), turning a single compromised identity into broad cloud data access. Separately, **Bumble** reported a phishing-driven compromise of a **contractor account**, after which ShinyHunters allegedly claimed theft of ~**30 GB** of data—reported as largely internal files sourced from **Google Drive** and **Slack**—while Bumble stated there was no evidence of exposure of user chats or profiles. Reporting also tied ShinyHunters to other claimed or alleged thefts affecting consumer and enterprise brands (including Match Group properties such as *Hinge*, *Match*, and *OkCupid*), consistent with the broader pattern of leveraging compromised identities and SaaS access paths for data exfiltration and extortion leverage.
Jun 29, 2026
Brinks Home disclosed that attackers gained unauthorized access to part of its IT environment and are threatening to leak allegedly stolen data, while extortion group **ShinyHunters** has claimed responsibility for the intrusion. The company said it detected the incident on July 20 and immediately began incident response, adding that its alarm monitoring operations, products, and core system functionality were not affected based on current findings. ShinyHunters alleges it accessed Brinks Home on July 13 through a Microsoft Entra voice-phishing attack and exfiltrated more than **4.9 million** Salesforce records, including some employee personally identifiable information, customer support chat logs, and other data from the company’s Salesforce environment. Brinks Home said it is still determining exactly what information was involved and which individuals may be affected, and warned customers that threat actors may use the incident to send fraudulent messages impersonating Brinks Home or its response partners.
Aug 10, 2026