ShinyHunters Claims Leak of 435,963 Neogen Records After Extortion Bid

The cybercriminal group ShinyHunters has published data it claims was stolen from Neogen, a major organization in the food and animal safety sector. The leak was confirmed after the group’s initial "pay or leak" extortion attempt in August 2026 failed to result in a ransom payment.

According to records added to the Have I Been Pwned database on October 9, 2026, the incident compromises 435,963 unique accounts. The exposed information consists primarily of corporate contact records derived from mailing lists, employee files, and other internal contacts. The data types explicitly listed in the breach record include email addresses, full names, employers, job titles, phone numbers, physical addresses, and salutations.

Context and Background

The breach timeline indicates that the initial security incident and subsequent extortion demand occurred in August 2026. ShinyHunters, a known ransomware and extortion group, typically follows a pattern of demanding payment in exchange for not releasing stolen data. In this instance, the group proceeded to publish the information after Neogen did not comply with the ransom demand.

The data was verified and added to the Have I Been Pwned archive on October 9, 2026, at 07:06:25 UTC. This public listing allows individuals and security professionals to check whether their contact information appears in the dataset. The verification status is marked as true, confirming the authenticity of the leak within the context of the breach database.

Who is Affected

The primary target of this breach is Neogen and its associated workforce and contact network. The 435,963 affected accounts represent a significant portion of the organization’s external-facing and internal communication records. Individuals whose data appears in this leak include current employees, past contacts, and addresses found in corporate mailing lists.

The exposure of physical addresses and phone numbers alongside professional details such as job titles and employers creates a comprehensive profile of the individuals involved. This level of detail can facilitate targeted social engineering attacks, such as spear-phishing campaigns, against Neogen staff and their professional associates. The inclusion of salutations and employer information further aids threat actors in crafting convincing fraudulent communications.

What should you do?

Security teams at Neogen and organizations that have interacted with the company should treat emails from Neogen contacts with heightened scrutiny. The availability of accurate job titles and physical addresses increases the risk of successful pretexting attacks. Users should verify the identity of senders through secondary channels before sharing sensitive information or clicking on links.

Individuals should check the Have I Been Pwned website to see if their email address is among the 435,963 affected records. If a user’s data is present, they should be aware that their professional contact details, including phone numbers and physical addresses, are publicly accessible. This does not necessarily mean passwords were compromised, but it does increase the attack surface for credential-stuffing and phishing attempts.