2026 CyrusOne — ShinyHunters leak-site claim; ~12.9M Salesforce records + facility docs (unverified)
Data compromised
Actor claims ~12.9M Salesforce records, ~370GB SharePoint, >8,300 employee PII, contracts/MSAs, floor plans, electrical diagrams, badge audits, key inventories, password lists, CERM docs (unverified)
Technical writeup
Unverified leak-site / extortion claim — Cybernews August 25, 2026. ShinyHunters listed a redacted FINAL WARNING on August 20 with an August 24 contact deadline, then on August 23 named CyrusOne, LLC with an alleged ~$13 million ransom and an inventory including ~12.9 million Salesforce records, hundreds of thousands of Contacts rows, ~369.6GB compressed SharePoint (~645GB uncompressed claimed), >8,300 employee PII records, contracts/MSAs/NDAs, data-center floor plans and electrical diagrams, access-control/badge audits, physical key inventories, security policies, Critical Environment Reliability Management documentation, and password/credential artifacts. Cybernews reported no published samples at indexing and no public CyrusOne comment. recordsAffected 12900000 uses the actor Salesforce headline (unverified); companyConfirmed false.
Root cause
Unverified ShinyHunters extortion listing (named Aug 23 after Aug 20 redacted FINAL WARNING); $13M demand; no samples at Cybernews indexing