Charter Communications Confirms Cybersecurity Incident Amid ShinyHunters Extortion Threats Charter Communications, a major U.S. telecommunications provider operating under the Spectrum brand, has acknowledged a cybersecurity incident after the ShinyHunters extortion group claimed to have breached its systems and stolen data belonging to over 42 million customers. The threat actor added Charter to its leak site this week, alleging the company ignored extortion demands and warning that the stolen data will be released if negotiations do not begin by May 27, 2026. ShinyHunters claims the breach exposed personally identifiable information (PII), though the exact nature of the compromised data remains unverified. In a statement to CyberInsider, a Charter spokesperson confirmed the company is investigating the incident and collaborating with authorities, asserting that "no sensitive personal information (PI) or customer proprietary network information (CPNI) was exfiltrated." However, Charter has not disclosed how the attackers gained access or whether internal systems were disrupted. The breach appears connected to a large-scale campaign targeting Salesforce environments and enterprise cloud infrastructure, where ShinyHunters has exploited exposed credentials, authentication tokens, or misconfigured integrations. Earlier this month, the group claimed responsibility for compromising hundreds of organizations in a Salesforce-focused operation, leveraging vulnerabilities in cloud credentials and third-party SaaS platforms. ShinyHunters has emerged as one of the most active cybercrime groups targeting enterprise cloud environments, with recent attacks on outsourcing providers, SaaS platforms, and educational technology firms. The group typically steals large datasets before demanding ransom under threats of public disclosure. As of now, Charter has not confirmed the number of affected customers or whether impacted individuals will be notified. The investigation remains ongoing.

Cushman & Wakefield Confirms Data Breach Following Dual Cyberattacks by ShinyHunters and Qilin Real estate firm Cushman & Wakefield (C&W) has acknowledged a limited data breach after two cybercrime groups ShinyHunters and Qilin independently claimed responsibility for attacks on the company. The incident originated from a vishing (voice phishing) attack, suggesting an employee was manipulated through social engineering. A C&W spokesperson stated that the company detected the breach, activated response protocols, and engaged third-party experts to investigate. While the company assured that systems and operations remain unaffected, it did not address the dual claims by the two threat actors. ShinyHunters, known for its pay-or-leak extortion model, alleged it breached C&W on May 1, stealing over 500,000 Salesforce records containing PII and internal corporate data. The group set a May 6 deadline for C&W to respond before leaking the data, though no contact was reportedly made. Meanwhile, Qilin, currently ranked as the world’s most prolific ransomware group, listed C&W on its leak site on May 4 but did not disclose attack details. The timing of the two incidents appears coincidental, as there is no known collaboration between the groups. ShinyHunters has been particularly active in recent months, claiming responsibility for high-profile breaches, including a supply chain attack on Salesforce in March that exposed data from over 100 customers. Other victims linked to the group include ADT, Carnival Cruise Line, Rockstar Games, and Vimeo, though not all attacks were directly tied to the Salesforce compromise.

ADT Inc. Stock Drops Amid Cybersecurity Breach Disclosure On May 4, 2026, ADT Inc. [NYSE: ADT] saw its stock decline by 6.49% following the disclosure of unauthorized access to certain cloud-based environments. The breach, which affected limited customer and prospect data, was contained under the company’s incident response protocols. ADT stated that it does not currently expect a material financial or operational impact, though the review remains ongoing. The stock, trading near $7, showed cautious but measured selling rather than panic, reflecting investor sentiment that the incident may be a reputational setback rather than a systemic threat. The company’s financials remain stable, with annual revenue of $5.13 billion, strong operating cash flow ($638 million), and free cash flow near $487 million. Despite high debt levels (debt-to-equity of 2.04), ADT maintains solid interest coverage, providing flexibility to address cybersecurity concerns. While the breach did not trigger a sharp sell-off, traders are monitoring the situation closely, as repeated security lapses could erode long-term confidence. The stock’s range-bound movement suggests that investors are weighing ADT’s strong cash flow against the potential risks of future incidents. Further updates on the breach review may influence trading activity.

Instructure Confirms Data Breach as ShinyHunters Claims Theft of 275 Million Records U.S.-based edtech provider Instructure, the company behind the widely used Canvas learning management system, has confirmed a cyberattack resulting in the theft of user data. The ShinyHunters extortion group has claimed responsibility, listing Instructure on its data leak site and alleging the exposure of 275 million records tied to students, teachers, and staff across nearly 9,000 schools worldwide. Instructure disclosed the incident on Friday, stating it was working with third-party cybersecurity experts and law enforcement to investigate. An update on Saturday revealed that personally identifiable information (PII) including names, email addresses, student ID numbers, and private user messages was compromised. The company stated that passwords, financial data, dates of birth, and government identifiers were not affected, though it would notify impacted institutions if new evidence emerged. As part of its response, Instructure deployed patches, increased monitoring, and rotated application keys, requiring customers to re-authorize API access with new credentials. While the company has not confirmed the breach timeline or extortion demands, ShinyHunters claimed the attack exploited a now-patched vulnerability in Instructure’s systems. The threat actor’s leak site alleges the stolen data includes 240 million records containing names, email addresses, enrolled courses, and private messages between students and teachers. The dataset reportedly spans 15,000 institutions across North America, Europe, and the Asia-Pacific region, with ShinyHunters also claiming access to Instructure’s Salesforce instance and additional undisclosed data. BleepingComputer has not independently verified the full scope of the breach or the affected institutions. Instructure has not responded to requests for further details on the threat actor’s claims.

ADT Hit by "Pay or Leak" Extortion Attack, Exposing 5.5M Email Addresses ADT, a leading security and smart home services provider, suffered a data breach involving a "pay or leak" extortion scheme, resulting in the public exposure of 5.5 million unique email addresses. The leaked data also included names, physical addresses, phone numbers, and a limited number of dates of birth and partial Social Security numbers. The breach was disclosed today, with analysis revealing that 71% of the exposed email addresses were already linked to LinkedIn profiles, suggesting a significant overlap with professional networks. The incident highlights the growing threat of extortion-based cyberattacks, where threat actors demand payment to prevent the release of stolen data. ADT has not confirmed whether a ransom was paid or if the attackers followed through on their threat after demands were ignored. The company is likely conducting an internal investigation to assess the full scope of the breach and its potential impact on affected customers. The exposure of personal and sensitive information raises concerns about identity theft and targeted phishing campaigns.

ADT Data Breach Exposes 5.5 Million Customer Records in SSO Attack Security and smart home provider ADT confirmed a data breach affecting 5.5 million customers after hacking group ShinyHunters compromised an employee’s Okta single sign-on (SSO) credentials through a voice phishing (vishing) attack. The breach, detected on April 20, exposed customer names, phone numbers, addresses, and in some cases Social Security and Tax ID numbers, though payment information remained secure. ADT responded by terminating the unauthorized access, launching a forensic investigation with third-party cybersecurity experts, and notifying law enforcement. According to Bleeping Computer, ShinyHunters gained entry via an ADT Salesforce account after obtaining the employee’s Okta login details through vishing a tactic also linked to the group’s recent Panera Bread breach. ShinyHunters, known for high-profile attacks on companies like Rockstar Games, Crunchyroll, and Bumble, has increasingly targeted SSO vulnerabilities. Okta recently warned about the rise of vishing attacks, which manipulate victims into divulging credentials over the phone. The breach highlights the growing risk of SSO-based attacks and the persistent threat posed by cybercriminal groups exploiting human and technical weaknesses in enterprise security.

ADT Suffers Data Breach as ShinyHunters Claims Theft of 10 Million Records ADT, the Florida-based home security provider, confirmed a cyberattack on Monday that resulted in the theft of customer and prospective customer data. The breach exposed names, phone numbers, addresses, dates of birth, and the last four digits of Social Security numbers and tax IDs though payment data and security systems remained unaffected. While ADT did not disclose the number of impacted individuals or whether a ransom was demanded, the cybercriminal group ShinyHunters later claimed responsibility, alleging the theft of 10 million records and threatening to leak the data unless paid. ADT has notified affected customers and is offering identity protection services where necessary. Law enforcement has been alerted, and third-party cybersecurity experts are assisting in the investigation. This incident marks the latest in a series of attacks by ShinyHunters, which has targeted high-profile organizations in recent months, including Rockstar Games, McGraw Hill, Bumble, and the European Commission. The group resurfaced earlier this year after a period of reduced activity, following legal setbacks in 2025 when two members were sentenced one to 22 years in prison and another to 10 years. ADT, which reported $5.1 billion in revenue last year, has faced multiple cybersecurity breaches in the past two years, including prior incidents involving customer and employee data. The company continues to respond to the latest attack as authorities monitor the situation.

Charter Communications Confirms Data Breach Amid Contradictory Claims by ShinyHunters In April, Charter Communications parent company of Spectrum, which serves millions of U.S. customers experienced a data breach linked to the hacking group ShinyHunters. The company confirmed the incident to Tom’s Guide, stating that no sensitive personal or business information was compromised, including customer proprietary network information (CPNI). However, ShinyHunters contradicted Charter’s claims, asserting that it stole 40 million records containing customer names, email addresses, phone numbers, plan details, and some CPNI data. The group reportedly breached Charter on April 1 via a voice phishing attack that compromised an employee account. Additional data, such as support ticket information, was also allegedly taken. Charter maintains that its security protocols were activated and authorities were notified, but the discrepancy between the company’s statement and the hackers’ claims remains unresolved. ShinyHunters’ Recent Activity The group has been highly active in 2024, with at least three major breaches attributed to it this year alone. In February, it targeted Panera, exposing data for over 5 million customers. In March, identity protection firm Aura suffered a breach affecting nearly 1 million individuals, followed by a 5.5-million-customer breach at ADT in April. ShinyHunters, active since 2019, continues to pose a significant threat to both consumer and business data, with no signs of slowing down.

ADT Data Breach Litigation Sees Plaintiff Dropouts Amid ShinyHunters Attack Fallout A legal battle over a 2023 data breach at ADT Inc. has seen a reduction in plaintiffs after several individuals filed motions to voluntarily dismiss their claims without prejudice. The lawsuits, consolidated in the U.S. District Court for the Southern District of Florida, stem from a ShinyHunters voice phishing attack that compromised 5.5 million customer accounts. While ADT confirmed that payment information remained secure, the breach exposed sensitive data including birthdates, partial Social Security numbers, and Tax IDs for a subset of affected users. The dismissals suggest shifting legal strategies or settlements among plaintiffs, though the core litigation against the security firm continues. The incident highlights the growing threat of social engineering attacks targeting large-scale service providers, with ShinyHunters a notorious hacking group previously linked to breaches at major companies. No further details on the attackers’ methods or ADT’s response have been disclosed. The case remains active in federal court.

A former employee had gained unauthorized access to the accounts of 220 customers, all of them located in the Dallas area. ADT was subjected to two lawsuits, both seeking class-action status. The former ADT technician Telesforo Aviles installed indoor security cameras at homes across Dallas and added his personal email address to the accounts and could easily access the cameras and spy on customers. He did this repeatedly over a period of seven years to hundreds of customers. ADT was accused of failing to fix vulnerabilities in its ADT Pulse software, which the company relies on to access the security system, including cameras and smart locks, installed in each customer's home.