INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Charter Communications suffers data breach impacting nearly 5 million

| 2026-05-29 08:29 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
Charter Communications data breach occurred in early April 2026, when the ShinyHunters extortion gang hacked into the company's systems using a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account. The attackers stole personal information from approximately 4.9 million accounts, including names, email addresses, physical addresses, phone numbers, and job titles, which were later leaked on their dark web leak site. ShinyHunters claimed responsibility for the breach and demanded a ransom in exchange for returning and destroying the stolen data, but Charter refused to pay. The incident affected 4.9 million accounts worldwide, with some records originating from an internal employee directory also being compromised, including job titles.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Salt TyphoonSalt Typhoon
Target & Sectors
Global Scope telecommunicationstelecommunications
Incident Timeline
‎2026/05/29
The ShinyHunters extortion gang, tracked as a Chinese state-backed threat group known as Salt Typhoon, breached Charter Communications' systems on April 1 using voice phishing (vishing) to steal personal information from approximately 42 million records.
victims 92,000 employees
Charter has over 92,000 employees and provides internet, mobile, video, and voice services to more than 32 million customers and over 57 million homes in 41 states across the U.S. through its Spectrum brand.
victims 32 customers
Charter has over 92,000 employees and provides internet, mobile, video, and voice services to more than 32 million customers and over 57 million homes in 41 states across the U.S. through its Spectrum brand.
threat_actor Salt Typhoon
…ter Communications' systems were also compromised in a wave of breaches by a Chinese state-backed threat group tracked as Salt Typhoon that also impacted AT&T, Verizon, Consolidated Communications, Windstream, and Lumen, as well as telecom compan…
data_breach 42 records
The threat actors claimed they used this access to steal 42 million records from the company's Salesforce instance, including consumer and business customer names, email addresses, physical addresses, phone numbers, phone types, plan information, su…
Tactical Metrics
Metrics
victims
92,000
Employees
Charter has over 92,000 employees and provides internet, mobile, video, and voice services to more than 32 million customers and over 57 million homes in 41 states across the U.S. through its Spectrum brand.
Metrics
victims
32,000,000
Customers
Charter has over 92,000 employees and provides internet, mobile, video, and voice services to more than 32 million customers and over 57 million homes in 41 states across the U.S. through its Spectrum brand.
Metrics
data_breach
42,000,000
Records
The threat actors claimed they used this access to steal 42 million records from the company's Salesforce instance, including consumer and business customer names, email addresses, physical addresses, phone numbers, phone types, plan information, su…
Intelligence Sources
BleepingComputer 2026-05-29