ShinyHunters Claims CyrusOne Data Theft After $13 Million Demand
Summary
Ransomware.live reports an unverified ShinyHunters claim that CyrusOne faces a $13 million demand and alleged theft of 12.9 million Salesforce records and SharePoint files, with a 24-hour deadline before threatened leakage.
Key points
- Ransomware.live attributes the claims to ShinyHunters; the article says it cannot confirm their accuracy.
- The group claims CyrusOne refused a $13 million demand and has 24 hours to engage before threatened data leakage and additional digital disruptions.
- ShinyHunters alleges it holds 12.9 million Salesforce records and 288,729 SharePoint files, totaling 369.6 GB compressed or 645 GB uncompressed.
- The claimed data includes more than 182,000 customer-data rows and over 8,300 employee records containing personal information.
- The group also claims to have contracts, data-center plans, security documents, access-control artifacts, and physical key inventory logs.
Article Details
- Victim
- CyrusOne, LLC.
- Claim Date
- 2026-08-23
- Encryption Status
- Not disclosed
- Exfiltration Status
- Shinyhunters claimed data was obtained; the claim is unverified in the source.
- Exfiltrated Data
- The group claimed to have obtained Salesforce records and SharePoint files, including customer and employee information, contracts, data center and security documentation, and access-control artifacts.
- Exfiltrated Size
- The group claimed 12.9 million Salesforce records and SharePoint data totaling 369.6 GB compressed / 645 GB uncompressed, across 288,729 files and 60,513 folders.
- Ransom Demand
- The group claimed it demanded $13 million and that the victim refused; these claims are unverified in the source.
- Leak Status
- The group threatened to leak data if its demand was not met; no leak is reported in the supplied content.
Threat Actors
Products
Microsoft SharePointThe attackers alleged theft of 12.9 million Salesforce records plus substantial SharePoint files and sensitive business, employee, and security documentation, warning of data leakage if demands were not met.Okta SSCCredential and access-control artifacts were also obtained, including PasswordList.xlsx, Okta SSC access lists, active badge reports, and multiple Data Center Access Control forms.SalesforceThe attackers alleged theft of 12.9 million Salesforce records plus substantial SharePoint files and sensitive business, employee, and security documentation, warning of data leakage if demands were not met.