Charter confirms breach after ShinyHunters claims 40 million records
Charter Communications, the U.S. company behind the Spectrum cable and internet brand, confirmed a data breach after the ShinyHunters extortion group listed it on its leak site and claimed to have stolen about 40 million records, BleepingComputer reported on May 26.
Charter is one of the largest telecommunications providers in the U.S., and the breach is part of a wider ShinyHunters campaign that relies on phoning employees and tricking them into handing over access to cloud accounts.
What happened
Charter said it was aware of the situation, was following its security protocols and was alerting the appropriate authorities. It said no sensitive personal information or customer proprietary network information, the regulated call and service records telecoms must protect, was taken. It did not say how the attackers got in.
ShinyHunters says it breached Charter on April 1 through a voice phishing call that compromised an employee's Microsoft Entra account, then used that access to export consumer and business customer records from Charter's Salesforce instance. The group claims the data includes names, email and physical addresses, phone numbers, plan details, support ticket data and some customer network information. It set a May 27 deadline for Charter to negotiate, CyberInsider reported.
The leak
The group later published the dataset. Have I Been Pwned found 4.9 million unique email addresses along with names, phone numbers and physical addresses, and about 85,000 records from an internal employee directory that included job titles, according to CyberInsider. The record count claimed by the attackers has not been independently verified, and Charter has not said how many customers it will notify.
Part of a wider campaign
ShinyHunters has spent the past year targeting companies through their cloud customer relationship platforms, often by calling staff and posing as IT support. CyberInsider tied the Charter breach to a Salesforce-focused campaign the group said earlier in May had reached hundreds of organizations.
What to do
Spectrum customers should expect convincing phishing that references their plan or past support tickets. Do not share account PINs or one-time codes with callers, and contact Charter through the number on your bill if a message seems urgent. Businesses should require call-back verification before help desks reset credentials or grant access.
