Charter Confirms Breach as ShinyHunters Claims Theft of 40 Million Records
Summary
Charter confirmed a breach and said no sensitive personal information or CPNI was exfiltrated. ShinyHunters claims it used vishing to access an employee’s Microsoft Entra account and steal 40 million records from Salesforce.
Key points
- Charter said it is following security protocols and alerting authorities after the incident.
- Charter stated that no sensitive personal information or customer proprietary network information was exfiltrated.
- ShinyHunters claims it breached Charter on April 1 through a vishing attack that compromised an employee’s Microsoft Entra account.
- The group claims it exported 40 million customer and business records from Charter’s Salesforce instance.
- ShinyHunters says the records include contact details, plan information, some CPNI data, and customer support tickets; these theft claims are not independently confirmed in the article.
Article Details
- Victim Organization
- Charter Communications
- Incident Type
- Data breach reportedly initiated through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account. ShinyHunters claimed responsibility; Charter confirmed a breach but disputed the claimed exfiltration of sensitive personal and CPNI data.
- Incident Date
- 2026-04-01
- Data Types Exposed
- Customer names (claimed by ShinyHunters; not confirmed by Charter)
- Email addresses (claimed by ShinyHunters; not confirmed by Charter)
- Addresses (claimed by ShinyHunters; not confirmed by Charter)
- Phone numbers and phone type (claimed by ShinyHunters; not confirmed by Charter)
- Plan information (claimed by ShinyHunters; not confirmed by Charter)
- Some customer proprietary network information (CPNI) (claimed by ShinyHunters; Charter said no CPNI was exfiltrated)
- Customer support ticket data (claimed by ShinyHunters; not confirmed by Charter)
- Affected Records
- ShinyHunters claimed 40 million records were stolen; Charter did not confirm this figure.
- Operational Impact
- Charter said it was following security protocols and alerting appropriate authorities. No service disruption or other operational impact was reported.
- Ransom Or Extortion
- ShinyHunters threatened to leak the allegedly stolen data unless a ransom was paid. No payment was confirmed.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Vendors
MicrosoftShinyHunters claimed to BleepingComputer that they breached Charter on April 1 through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account.SalesforceThe threat actors used this access to export millions of consumer and business customer records from the company's Salesforce instance.
Products
Microsoft EntraShinyHunters claimed to BleepingComputer that they breached Charter on April 1 through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account.SalesforceThe threat actors used this access to export millions of consumer and business customer records from the company's Salesforce instance.