Ransomware Group shinyhunters Hits: CyrusOne, LLC.
Summary
In the latest cybersecurity news, CyrusOne, LLC. — an organization based in US — has fallen victim to a ransomware attack conducted by the group shinyhunters. This data breach, discovered on 2026-08-23T20:27:42.698495+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | CyrusOne, LLC. |
| Threat Group | shinyhunters |
| Summary | Update 23 Aug : We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records along with: Sharepoint: (369.6 GB Compressed / 645 GB Uncompressed) 288,729 Files, 60,513 Folders – More than 182,000 rows of Customer data Extracted from the “Contacts” Salesforce Object. – Over 8,300 Rows of Employee PII (Full Name, Email, Job Title, Phone Number, ect.) – Thousands of executed contracts, MSAs, NDAs, amendments, leases, and SOWs – Extensive physical key inventory logs, verification photos, and contractor Green Badge audits – Large collection of data center drawings, floor plans, electrical one-line diagrams, security system drawings, and site schematics – Full CERM (Critical Environment Reliability Management) process library – Physical and information security policy suite plus governance materials – Regional security scorecards, KPI workbooks, GAM sheets, and signed performance packages – Credential and access-control artifacts (including PasswordList.xlsx, Okta SSC Access lists, active badge reports, and multiple Data Center Access Control forms) This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that’ll come your way. Make the right decision, don’t be the next headline. | Updated: 23 Aug 2026 | Warning: FINAL WARNING PAY OR LEAK |
| Date of Breach | 2026-08-23T11:10:00+00:00 |
| Discovery Date | 2026-08-23T20:27:42.698495+00:00 |
| Region | US |
| Business Sector | Technology |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- awareness training — close the gap attackers exploit.
- keep watch on the dark web — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
Related articles
Ransomware Group coinbasecartel Hits: Westwing Group SE
Ransomware Group qilin Hits: S.E.M.P. s.r.l.
Ransomware Group killsec Hits: Global Go
