ShinyHunters Claims Amtrak Salesforce Data in Pay-or-Leak Threat
Summary
ShinyHunters claims it compromised over 9.4 million Amtrak Salesforce records containing PII and other internal data, demanding payment by April 14, 2026, or threatening to leak the data and cause disruption. The claim is unverified.
Key points
- The post attributes the claim to ShinyHunters and identifies National Railroad Passenger Corporation (Amtrak) as the victim.
- The actor reportedly claims over 9.4 million Salesforce records containing PII and other internal corporate data were compromised.
- The claim threatens data leakage and further digital disruption if Amtrak does not respond by April 14, 2026.
- The post says it is based on public group claims and that their accuracy is unconfirmed; it is monitored by ransomware[.]live.
Article Details
- Victim
- National Railroad Passenger Corporation (Amtrak)
- Victim Domain
- amtrak.com
- Claim Date
- 2026-04-11
- Exfiltration Status
- Claimed compromised; unverified
- Exfiltrated Data
- The claim reports that Salesforce records containing PII and other internal corporate data were compromised.
- Exfiltrated Size
- Over 9.4 million records, as claimed
- Ransom Demand
- Pay or leak; no amount reported
- Leak Status
- Leak threatened if payment is not made; no leak is reported as having occurred.