Have I Been Pwned loads 373,460 email addresses from the CyrusOne data published after a ShinyHunters 'pay or leak' extortion attempt (breach August 2026)
Have I Been Pwned added CyrusOne on 7 October 2026 (UTC). It says data centre operator CyrusOne was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, after which the group published data allegedly taken from the company. HIBP counts 373,460 unique email addresses across records about users, sales leads and CyrusOne employees, mostly corporate contact details: names, physical addresses, phone numbers, employers and job titles, plus support tickets and other operational information. HIBP lists the breach as verified. When ShinyHunters first made its claim in August, Cybernews reported the group said it held 12.9 million Salesforce records and was demanding US$13 million, and listed floor plans, electrical diagrams and access-control records among the alleged data; HIBP's description covers contact data and support tickets and does not confirm those facility documents. CyrusOne had not commented publicly at the time of Cybernews' report. Primary: Have I Been Pwned.
- Product
- CyrusOne (data centre operator) customer, sales-lead and employee contact records and support tickets
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Check your work address on Have I Been Pwned. CyrusOne customers: expect convincing phishing that quotes real support tickets or account managers, and confirm any change to access, billing or remote-hands requests through a known contact. Review which Salesforce or CRM integrations hold your support history and who can export it.
Primary: Have I Been Pwned — CyrusOne breach (added 7 Oct 2026; breach 5 Aug 2026) · Cybernews — ShinyHunters claims CyrusOne breach, $13 million extortion demand (25 Aug 2026)