Data centre operator CyrusOne was hit by a ShinyHunters “pay or leak” extortion campaign in August 2026, with the group later publishing data allegedly stolen from the company. The dump included roughly 373,000 unique email addresses tied to users, sales leads, and CyrusOne employees, along with names, physical addresses, phone numbers, and job titles. Support tickets and operational records were also exposed.
While the leaked data is largely corporate contact information rather than passwords, the inclusion of employee details is significant for identity security. Harvested names, job titles, and email addresses provide ready-made material for targeted phishing, business email compromise, and social engineering aimed at gaining a foothold into corporate identity systems.
What to take away: exposed employee directories and contact data fuel credential-phishing and impersonation attacks. Organizations should treat such leaks as a trigger to reinforce MFA, watch for targeted phishing against named staff, and monitor for anomalous authentication attempts.