Charter Communications Hit by ShinyHunters Ransomware Attack, Customer Data at Risk Charter Communications, the parent company of Spectrum and one of the largest U.S. broadband and cable providers serving over 32 million customers across 40 states has confirmed a cybersecurity incident after the ransomware group ShinyHunters listed it on a data leak site. ### What Happened? The breach came to light when ShinyHunters claimed to have infiltrated Charter’s systems, threatening to release stolen data unless a ransom was paid. Charter acknowledged the incident, stating that only sales tools for business customers were affected and that no sensitive personal information (PI) or customer proprietary network information (CPNI) such as account details or service data was exposed. However, ShinyHunters disputes this, alleging the theft of millions of records, including: - Customer names, emails, and home addresses - Phone numbers and device types - Service plan details and support ticket data - Some private telecom account information The group claims the attack occurred on April 1, 2026, via a voice phishing (vishing) scam, where attackers impersonated IT support to gain access to an employee’s Microsoft Entra account. From there, they allegedly breached Charter’s Salesforce system to extract the data. ### Why It Matters While Charter insists the breach was limited, the exposure of even basic customer details such as names, emails, and phone numbers poses risks. Scammers could use this information to craft convincing phishing attacks, impersonating Spectrum or billing support to trick customers into revealing login credentials or payment details. ### Key Takeaways - Discrepancy in Claims: Charter maintains that no sensitive data was released, while ShinyHunters asserts a far broader breach. - Attack Vector: The incident highlights the growing threat of vishing, where social engineering over phone calls bypasses technical defenses. - Corporate Response: Charter is working with authorities and following security protocols, but the full scope of the breach remains unclear. The incident underscores the need for employee training on phone-based scams and stronger access controls for cloud-based business tools like Salesforce and Microsoft Entra. For now, customers are advised to remain vigilant against potential follow-up scams leveraging the leaked data.