ShinyHunters Claims Ameriprise Financial Data, Threatens Leak by March 25
Summary
ShinyHunters claims it compromised Ameriprise Financial Salesforce records containing PII and more than 200GB of compressed SharePoint data, threatening a leak and additional disruption unless contacted by March 25, 2026. The claim is unconfirmed.
Key points
- ShinyHunters is attributed with claiming that Ameriprise Financial was compromised; the article says the claim is unconfirmed.
- The group claims Salesforce records containing PII were compromised.
- The claim also describes more than 200GB of compressed SharePoint internal corporate data.
- ShinyHunters allegedly issued a final warning to make contact by March 25, 2026, threatening to leak data and cause additional digital disruptions.
Article Details
- Victim
- Ameriprise Financial, Inc.
- Claim Date
- 2026-03-22
- Encryption Status
- Not disclosed.
- Exfiltration Status
- Unverified; the ransomware group claimed data was compromised, but exfiltration is not independently confirmed.
- Exfiltrated Data
- The group claimed Salesforce records containing PII and internal corporate data from SharePoint were compromised.
- Exfiltrated Size
- The group claimed over 200GB of compressed SharePoint internal corporate data; no size was reported for the Salesforce records.
- Ransom Demand
- No ransom amount reported; the group demanded contact by 2026-03-25.
- Leak Status
- The group threatened to leak data if contacted by 2026-03-25; no leak was reported.
Threat Actors
Products
Microsoft SharePointFinancial, Inc., in the United States, Salesforce records containing PII and over 200GB compressed SharePoint internal corporate data have been compromised by the threat actor shinyhunters.SalesforceA ransomware claim reports that Ameriprise Financial, Inc., in the United States, Salesforce records containing PII and over 200GB compressed SharePoint internal corporate data have been compromised by the threat actor