2026 BCD Travel — ShinyHunters leak; 396k emails verified (HIBP)
Data compromised
Unspecified corporate travel and client data per actor marketing
Technical writeup
ShinyHunters targeted Netherlands-headquartered corporate travel firm BCD Travel in late May 2026 as part of the broader Salesforce/vishing extortion wave. Have I Been Pwned loaded 396,313 unique email addresses in early June 2026 after the group published alleged BCD data, with names, addresses, phone numbers, job titles, and employer names spanning leads, staff, and support-ticket datasets. No BCD Travel English-language customer notice matching the HIBP scale was indexed at upgrade time; BreachHistory uses the HIBP-verified count.
Root cause
ShinyHunters extortion claim