2026 TinyPulse (WebMD) — employee survey platform breach; ShadowByte$ $2M extortion (Jun)
Data compromised
Internal employee survey and engagement data for enterprise customers; Nintendo confirmed limited survey content for a subset of staff (see nintendo-shadowbyte-tinypulse2026); actor claims broader HR artifacts including W-9s and bank statements—scope disputed by affected clients
Technical writeup
Verified third-party platform breach — June 2026. ShadowByte$ claimed June 13, 2026 to have stolen roughly 859MB–1GB from TinyPulse, a WebMD Health Services employee-engagement SaaS used for internal surveys, and demanded a $2 million ransom. Nintendo of America publicly confirmed TinyPulse was compromised and that internal survey data for a subset of employees was exposed while Nintendo's own systems were not breached. BreachHistory indexes this row as the platform incident; client-specific impact is tracked separately (e.g., nintendo-shadowbyte-tinypulse2026). Enterprise customers using TinyPulse for HR surveys should assume credential-reuse and spear-phishing risk until WebMD/TinyPulse publishes a consolidated victim count.
Root cause
Compromise of TinyPulse employee-engagement SaaS (WebMD Health Services subsidiary); ShadowByte$ extortion demanding $2M—downstream clients include Nintendo of America