2026 Crunchbase — ShinyHunters; HIBP 559,908 emails (leads/contacts)
Data compromised
HIBP (added 14 Oct 2026): 559,908 unique emails, largely leads and business contacts, plus names, physical addresses, phone numbers, job titles, employers, LinkedIn/social profiles. No passwords in the HIBP load. ShinyHunters claimed 2M+ records / ~400MB archive; Hudson Rock reported PII, contracts, and other corporate files in the dump. Crunchbase has not published its own census.
Technical writeup
Verified company confirmation to SecurityWeek (26 Jan 2026): documents exfiltrated from the corporate network; contained; systems secure; federal law enforcement contacted; reviewing whether legal notices are required. ShinyHunters leaked ~400MB ~23 Jan after ransom refused; claimed 2M+ records. Have I Been Pwned loaded the public corpus on 14 Oct 2026 as 559,908 unique emails (53% already in HIBP). recordsAffected 559908 (HIBP); actor 2M+ claim retained in writeup. companyConfirmed true.
Root cause
ShinyHunters pay-or-leak after a Dec 2025–Jan 2026 social-engineering / Okta–Google–Entra vishing wave. Company: threat actor exfiltrated certain documents from the corporate network; incident contained; operations not disrupted.
References
- https://haveibeenpwned.com/Breach/Crunchbase
- https://www.securityweek.com/crunchbase-confirms-data-breach-after-hacking-claims/
- https://securityaffairs.com/187340/data-breach/shinyhunters-claims-2-million-crunchbase-records-company-confirms-breach.html
- https://cybernews.com/security/shinyhunters-crunchbase-ransomware-hack/