Jack Henry Refuses Ransom Demand After Data Breach; ShinyHunters Threat Fizzles Jack Henry, a major U.S. financial technology provider, confirmed it was targeted in a ransomware extortion attempt by the cybercriminal group ShinyHunters but refused to pay. The hackers set a deadline for payment before leaking stolen data, yet no files were published after the deadline passed. The breach exposed personal information belonging to account holders at fewer than 10 client institutions, though the exact number of affected individuals remains undisclosed. Jack Henry, which supports over 1,600 banks and credit unions with core processing systems and serves an additional 5,600 financial institutions, stated that no client-facing systems or daily operations were disrupted. The attack began with a vishing (voice phishing) scheme, where ShinyHunters impersonated trusted contacts to obtain credentials. The intrusion was contained to a non-production corporate environment, and the company detected the breach "recently," though it has not specified the timeline of the attack or discovery. Jack Henry notified all 7,200+ clients and is offering two years of credit monitoring to affected institutions for their account holders. However, under federal regulations, financial institutions not Jack Henry are responsible for notifying impacted customers. The reporting timeline depends on whether the affected clients are banks (36-hour notice to regulators) or credit unions (72-hour notice to the NCUA). ShinyHunters has a history of targeting financial services, including breaches at TransUnion (4.4M records, August 2025), Betterment, and Figure Technology Solutions. While the group has previously followed through on threats, this incident marks a rare public refusal to pay, aligning with U.S. government guidance discouraging ransom payments. Financial institutions paid $365.6 million in ransomware extortion between 2022 and 2024, the highest of any industry, according to a 2025 FinCEN report. Despite federal warnings, many organizations continue to pay to avoid data leaks or operational disruptions.