The ShinyHunters cybercrime group has leaked stolen data from Charter Communications (Spectrum) after the company refused to negotiate following a ransom deadline that expired on May 27, 2026. While ShinyHunters initially claimed to have stolen 42 million records, independent analysis by Have I Been Pwned confirmed 4.9 million unique email addresses in the leaked dataset, along with names, phone numbers, and physical addresses.
The breach originated from a voice phishing (vishing) attack that compromised a Charter employee’s Microsoft Entra (Azure Active Directory) account around April 1, 2026. This access allowed the attackers to exfiltrate data from Charter’s Salesforce environment. The stolen data includes customer names, email addresses, home addresses, phone numbers, plan information, and support ticket data, along with approximately 27,000 employee records including job titles.
Charter Communications acknowledged the cybersecurity incident but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated. However, class action lawsuits have already been filed on behalf of affected customers, alleging that Charter failed to adequately protect their data.
Source
BleepingComputer · Have I Been Pwned · eSecurity Planet
Commentary
ShinyHunters are having a banner year. Between Charter, DentaQuest, and their other recent campaigns, they’ve established themselves as arguably the most prolific data extortion group operating today. What makes this breach particularly frustrating is the entry vector: a vishing call. Not a sophisticated zero-day, not a supply chain compromise — a phone call that tricked an employee into giving up their credentials.
The gap between ShinyHunters’ claimed 42 million records and the confirmed 4.9 million is worth noting. Threat actors routinely inflate numbers for leverage and publicity. That said, 4.9 million exposed accounts is still a massive breach for one of the largest ISPs in the United States. If you’re a Spectrum customer, assume your basic contact info is in the wild and act accordingly — especially watch for phishing attempts that reference your actual Spectrum account details.