ShinyHunters publishes 373k CyrusOne records after failed extortion bid

Data centre operator CyrusOne suffered a significant data exposure after extortion group ShinyHunters published records linked to the company. The group released the data in August 2026 following a "pay or leak" threat that CyrusOne did not satisfy.

The breach compromised 373,460 unique email addresses, according to a record added to the Have I Been Pwned database on October 7, 2026. The exposed dataset contains a mix of records relating to CyrusOne employees, sales leads, and users. While the bulk of the information consists of standard corporate contact details, the inclusion of internal operational data raises concerns about the depth of the intrusion.

Scope of the Exposure

The data published by ShinyHunters includes names, physical addresses, phone numbers, and job titles for the affected individuals. Beyond basic contact information, the leak contains support tickets and other data related to the organisation's operations. The presence of support tickets suggests that the threat actors may have accessed internal customer service platforms or databases, rather than simply harvesting publicly available contact lists.

The Have I Been Pwned record lists the breached domain as cyrusone.com and confirms the breach as verified. The data was added to the public breach database two months after the initial incident, providing a timeline for when the information became widely accessible to researchers and the affected parties.

Who Is Affected

The 373,460 affected accounts span three distinct groups: current CyrusOne employees, potential sales leads, and existing users of the data centre services. This mixture indicates that the attackers targeted both the company's internal workforce and its external business relationships.

For employees, the exposure of job titles and physical addresses creates risks for social engineering attacks and physical security threats. For users and sales leads, the leak of phone numbers and email addresses increases the likelihood of targeted phishing campaigns and spam. The inclusion of support tickets may also expose sensitive information about the technical issues or infrastructure details discussed during customer interactions.

What should you do?

No official patch or fix has been confirmed yet for this specific breach, as the data has already been published by the threat actors. Affected individuals should monitor their email accounts for phishing attempts that leverage the exposed personal details. Users should also be cautious of social engineering attacks that reference their job titles or previous support interactions.

CyrusOne customers should review their support ticket histories to identify any sensitive information that may have been included in the published data. Employees should update their personal security settings and be wary of unsolicited communications claiming to be from HR or IT departments.