Summary
Kodak has confirmed that an unauthorized third party gained temporary access to company data in a breach now claimed by the ShinyHunters extortion group. The threat actors allege they exfiltrated over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data, and have set a June 18 deadline for Kodak to respond before leaking the stolen data publicly.
Kodak stated it is working with external cybersecurity experts and law enforcement to investigate the scope of the breach. The company maintains there is no ongoing threat to its systems or operations, though it has not disclosed the initial access vector or confirmed the exact volume of compromised data.
This breach is part of an aggressive 2026 campaign by ShinyHunters, which has also been linked to attacks on Oracle PeopleSoft environments, Salesforce customer instances, and numerous other enterprise targets in recent weeks.
Source
BleepingComputer — Kodak Confirms Data Breach · CyberNews — ShinyHunters Claims Kodak Hack
Commentary
ShinyHunters is having an extraordinary 2026. Between the Oracle PeopleSoft university attacks, Salesforce compromises, and now Kodak, this group is operating at a tempo that rivals state-backed actors. The breadth of their targeting — from higher education to legacy consumer brands — suggests they are systematically exploiting common enterprise platform weaknesses rather than bespoke tradecraft per target.
For defenders, the takeaway is clear: ShinyHunters is not slowing down, and their repeated success against major organizations points to persistent gaps in cloud configuration, third-party integration security, and patch management across the enterprise landscape.