ShinyHunters Claims Breaches of Cisco Systems and Threatens Data Leak
Summary
ShinyHunters claims it breached Cisco systems, citing screenshots of access to an AWS console and storage volumes. The group alleges it has over 3 million Salesforce records and threatens a public leak if Cisco does not respond by April 3, 2026.
Key points
- ShinyHunters claims three intrusions involving environments associated with UNC6040, Salesforce Aura, and Cisco AWS accounts.
- The group provided screenshots it says show access to an AWS Management Console for Cisco Crosswork Network Controller and hundreds of storage volumes.
- ShinyHunters claims to hold more than 3 million Salesforce records allegedly taken from Cisco environments.
- The group demands Cisco contact it by April 3, 2026, or it will publicly leak data and pursue further disruptive actions.
- The article reports the group's claims; it does not establish that the alleged breaches or data access have been independently confirmed.
Article Details
- Victim Organization
- Cisco Systems, Inc.
- Victim Domain
- Unknown
- Incident Type
- Alleged data breach and extortion
- Data Types Exposed
- Salesforce records (contents not specified; claimed)
- Affected Records
- ShinyHunters claims to possess over 3 million Salesforce records; the claim is unverified.
- Affected Data Size
- Unknown
- Operational Impact
- No operational impact is confirmed. ShinyHunters threatened further disruptive actions if Cisco did not make contact by April 3, 2026.
- Ransom Or Extortion
- ShinyHunters demanded that Cisco contact them by April 3, 2026, threatening to publicly leak data and carry out further disruptive actions. No ransom amount is stated.
- Claim Status
- claimed
Threat Actors
Vendors
Amazon Web Servicesbreached Cisco Systems, alleging three separate intrusions affecting UNC6040, Salesforce Aura, and Cisco AWS accounts, with screenshots showing unauthorized access to an AWS Management Console for the Cisco CrossworkCiscoThe ShinyHunters extortion group claims to have breached Cisco Systems, alleging three separate intrusions affecting UNC6040, Salesforce Aura, and Cisco AWS accounts, with screenshots showing unauthorized access to anSalesforcegroup claims to have breached Cisco Systems, alleging three separate intrusions affecting UNC6040, Salesforce Aura, and Cisco AWS accounts, with screenshots showing unauthorized access to an AWS Management Console
Products
AWS Management ConsoleSalesforce Aura, and Cisco AWS accounts, with screenshots showing unauthorized access to an AWS Management Console for the Cisco Crosswork Network Controller and hundreds of internal storage volumes.Cisco Crosswork Network Controlleraccounts, with screenshots showing unauthorized access to an AWS Management Console for the Cisco Crosswork Network Controller and hundreds of internal storage volumes.Salesforce Auragroup claims to have breached Cisco Systems, alleging three separate intrusions affecting UNC6040, Salesforce Aura, and Cisco AWS accounts, with screenshots showing unauthorized access to an AWS Management Console