INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ShinyHunters Leaks 4.9M Charter Customer Records

| 2026-05-29 10:22 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On May 29, 2026, ShinyHunters, a cybercrime gang, added Charter Communications to its "trophy shelf" after leaking the personal details of approximately 4.9 million customers, including names, addresses, phones, and emails. The breach occurred despite Charter's apparent refusal to pay ransom demands made by the extortion crew, which claimed to have stolen over 42 million records belonging to consumer and business customers. ShinyHunters' tactics involve dumping stolen data online after a deadline for payment passes, as seen in this case where the gang updated its listing with a message stating that Charter failed to reach an agreement despite their "incredible patience." The incident is not Charter's first brush with high-profile intrusions, having been caught up in China's Salt Typhoon espionage campaign last year.
Technical Mitigations AI-generated
• Patch Charter's systems to address the vulnerability exploited by ShinyHunters, specifically addressing the issue with the internal staff directory. • Use a threat intelligence feed like Have I Been Pwned to detect and alert on potential data breaches involving similar tactics as ShinyHunters. • Block or hunt for IP addresses associated with ShinyHunters' known command-and-control servers.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Salt TyphoonSalt Typhoon
Target & Sectors
NORTH_AMERICA NORTH_AMERICA telecommunicationstelecommunications
Incident Timeline
‎May 2026
ShinyHunters added Charter to its trophy shelf after leaking approximately 4.9 million customer records, following the telecom provider's failure to reach an agreement with the attackers despite offers made by investigators.
threat_actor Salt Typhoon
The telecom provider was among the organizations reportedly caught up in China's Salt Typhoon espionage campaign last year , alongside a growing list of US telcos.
‎2026/05/29
ShinyHunters dumped the personal details of 4.9 million Charter Communications customers after the US telecom giant declined to pay their extortion demands.
data_breach 42 records
Charter appeared on the ShinyHunters leak site earlier this month, with the extortion crew claiming to have stolen more than 42 million records belonging to consumer and business customers.
The listing, seen by The Register , warned: "Over 42M records containing PII have been compromised.
"Over 42M records containing PII have been compromised.
data_breach 4.9 customer records
Cyber-Crime ShinyHunters adds Charter to trophy shelf after 4.9M customer records leak Telco giant says no sensitive data was taken, though names, addresses, phones, and emails are now out there ShinyHunters claims it has dumped the person…
ShinyHunters adds Charter to trophy shelf after 4.9M customer records leak.
victims 4.9 customers
According to Have I Been Pwned , the breach exposed the personal details of 4.9 million customers, including names, email addresses, phone numbers, and physical addresses.
data_breach 85,000 records
It says a smaller subset of roughly 85,000 records originating from an internal staff directory also contained job titles.
Tactical Metrics
Metrics
data_breach
4,900,000
Customer Records
Cyber-Crime ShinyHunters adds Charter to trophy shelf after 4.9M customer records leak Telco giant says no sensitive data was taken, though names, addresses, phones, and emails are now out there ShinyHunters claims it has dumped the person…
ShinyHunters adds Charter to trophy shelf after 4.9M customer records leak.
Metrics
data_breach
42,000,000
Records
Charter appeared on the ShinyHunters leak site earlier this month, with the extortion crew claiming to have stolen more than 42 million records belonging to consumer and business customers.
The listing, seen by The Register , warned: "Over 42M records containing PII have been compromised.
"Over 42M records containing PII have been compromised.
Metrics
victims
4,900,000
Customers
According to Have I Been Pwned , the breach exposed the personal details of 4.9 million customers, including names, email addresses, phone numbers, and physical addresses.
Metrics
data_breach
85,000
Records
It says a smaller subset of roughly 85,000 records originating from an internal staff directory also contained job titles.
Intelligence Sources
The Register - Cybercrime 2026-05-29