Pierluigi Paganini
May 30, 2026
The ShinyHunters extortion group has published data allegedly stolen from Charter Communications after the company apparently refused to pay a ransom. Charter Communications is one of the largest telecommunications companies in the United States. It provides internet, cable TV, mobile, and phone services to residential and business customers under the Spectrum brand, serving tens of millions of users across the country.
The leaked information reportedly includes more than 42 million customer records and customer proprietary network information (CPNI).
However, according to the data breach notification service HaveIBeenPwned, the number of impacted individuals is approximately 4.9 million.
“The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal employee directory also included job titles.” reports HIBP. “Charter confirmed the incident, but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated.”
The company confirmed it is aware of the incident, has activated its security procedures, and is cooperating with authorities. The issue affected sales-related systems used to manage current, former, and prospective business customers.
ShinyHunters is a well-known name in the cybercriminal ecosystem. The group is associated with a broader loosely connected network often referred to as “the Com,” made up largely of young, English-speaking individuals. Their operations typically focus on stealing data from large organizations and using leak sites to pressure victims into paying ransoms in cryptocurrency.
ShinyHunters has recently targeted major companies and organizations, leaking data when ransom demands fail. Victims include the European Commission, Odido, Figure, Canada Goose, Rockstar, Canvas, Carnival, 7-Eleven, and SoundCloud. The group primarily uses social engineering, especially voice phishing, to steal credentials and access SaaS platforms like Salesforce, Okta, and Microsoft 365.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Charter Communications)
