Charter Communications, the operator of the Spectrum broadband, cable, and mobile brand, confirmed a cybersecurity incident on May 26, 2026 after the extortion group ShinyHunters listed the company on its dark-web leak site one day ahead of a ransom deadline. Every account of the intrusion traces to the same chain: a voice phishing call on April 1, 2026 that produced Microsoft Entra credentials, followed by a bulk export from Charter's Salesforce environment. The record count is where the accounts diverge sharply. Have I Been Pwned loaded 4,851,517 unique email addresses on May 28, 2026. Cybernews, reviewing a sample of the leaked archive, counted at least 13 million individuals. ShinyHunters claims 40 million to 42 million. A note on sourcing: no primary document (a regulator filing, a direct company notification, or a CERT advisory) was available for this brief. Charter's own language is quoted here only as it was relayed by secondary reporting, principally BleepingComputer.
What Happened
The timeline that emerges across the available reporting is consistent on sequence, if not on scale. On April 1, 2026, a ShinyHunters operator phoned a Charter employee, posed as a trusted party, and convinced them to hand over credentials for a Microsoft Entra account (formerly Azure Active Directory). That single sign-on identity was enough to reach Charter's Salesforce instance, where the attackers exported customer records in bulk. No malware, no zero-day, no exploited edge device.
Nearly two months passed between that call and any public acknowledgment. The breach surfaced not through Charter's own detection but through extortion: ShinyHunters posted the company to its leak site on May 26, 2026, with a payment deadline of May 27. Charter confirmed an incident the same day the listing appeared, using deliberately narrow language. Per the statement quoted in the reporting, the company said it was "aware of the situation, following our security protocols and are working with appropriate authorities."
When the deadline passed without payment, the data was published. Have I Been Pwned ingested and processed the dataset, adding it on May 28. The darknet forum listing that later circulated the archive advertised it at 2.36 GB, while Cybernews described the sample it reviewed as a 1.5 GB compressed file, so the two are likely describing different packages of the same leak rather than the same object.
Litigation followed quickly. Kent v. Charter Communications was filed on June 1, 2026 in Connecticut federal court, where Charter is headquartered, and openclassactions.com reports it was the first of at least four related complaints in that district. Those complaints cite the 42 million figure. They are unproven allegations; there is no certified class, no settlement, and no finding of liability.
The Numbers Dispute
Three figures are in play, and they should not be collapsed into one.
Have I Been Pwned's 4,851,517 represents unique, verifiable email addresses inside the published data. That is the floor and the most defensible number, because it reflects a deduplicated count against actual records rather than a claim.
Cybernews's 13 million reflects individuals identified inside the specific archive it examined. Two sources describe this differently: shattered.io frames it as Cybernews counting 13 million people in the dataset it reviewed, while the AXIS teardown frames it as the attackers having published at least 13 million records after the deadline. Both readings are compatible with a leak larger than the email-address count.
ShinyHunters's 40 million to 42 million is an attacker claim on an extortion listing, published while the group still had an interest in maximizing perceived leverage. Multiple sources note the plausible explanation for the gap: Salesforce CRM tables routinely store several rows per customer across different interaction types, so a raw row count inflates well past the number of distinct people. That said, Charter serves roughly 32 million customers, so a 42 million row count is not arithmetically impossible; it is simply unverified.
Charter's own scale is also reported inconsistently. Tech-insider.org cites Fox News for a footprint reaching close to 58 million homes and businesses across 41 states; shattered.io puts it at more than 32 million customers across 40 states. Treat the state count as approximate.
What Was Taken
The confirmed contents, as loaded into Have I Been Pwned and echoed by the forum listing carrying the archive, are email addresses, names, phone numbers, and physical addresses. A subset of roughly 85,000 records originated from an internal employee directory and included job titles.
Beyond that, the accounts split cleanly along attacker and victim lines. ShinyHunters claims the haul also includes service plan information, customer support ticket data, and customer proprietary network information (CPNI), the regulated category covering what services a subscriber buys and how they use them. Charter directly disputes this. In its statement, the company said "no sensitive personal information (PI) or customer proprietary network information (CPNI) data was exfiltrated by the threat actor as a result of recent activity," and when BleepingComputer pressed on the CPNI point, Charter referred back to that same statement without elaborating.
The AXIS teardown, working from the published data, describes records containing names, email and physical addresses, phone numbers, plan information, and "some CPNI data," which cuts against Charter's denial. That is an analyst reading of the leak rather than a regulator finding, so the honest summary is that this remains contested. Charter has separately stated that no Social Security numbers or payment card data were taken, and nothing in the available reporting contradicts that.
The field names visible in the circulating sample are consistent with a Salesforce Account object export: billing account numbers, site street address, city, state and ZIP fields, router MAC address, tax status flags, and a privacy-customer indicator. Router MAC addresses and service-location data are the kind of operational detail that sit uncomfortably close to the CPNI line, which is likely where the dispute will be settled.
Why It Matters
Charter is the largest US name to land in the ShinyHunters vishing-to-SaaS campaign so far in 2026, but it is not an outlier. The pattern (social engineer a help desk or employee by phone, take over a federated identity, then use legitimate SSO access to bulk-export a CRM) has run against dozens of companies since mid-2025. A LinkedIn roundup by Manish Kumar of VIEH Group, which is commentary rather than verified reporting, places Charter alongside Instructure/Canvas, Carnival, 7-Eleven, NAIC, and the Match-owned dating brands in the group's 2026 run. Those individual figures are unverified here, but the shape of the campaign is corroborated by the technical detail in the Charter case.
Three things make this incident instructive for defenders.
First, detection failed entirely. The intrusion began April 1 and became public on May 26 only because the attackers chose to monetize it. Roughly eight weeks of dwell time ended with an extortion post, not an alert.
Second, the attacker used no capability a defender could patch. Every action was performed with valid credentials through a sanctioned integration path. Preventive controls that assume malicious tooling do not fire here; behavioral controls on data volume do.
Third, the scope dispute has a real cost. Charter's flat CPNI denial, contradicted by both the threat actor and by analysts reading the published files, is now the centerpiece of at least four federal complaints. For telecoms, CPNI is not just a sensitivity label; it carries specific FCC obligations. Getting the first public characterization wrong turns a breach into a credibility problem.
The Attack Technique
The chain is short and entirely identity-based:
- Vishing. An operator calls an employee, impersonates a trusted internal party such as IT support, and talks them into surrendering Microsoft Entra credentials. Reporting does not specify whether MFA was bypassed via real-time relay, push fatigue, or simple absence of a phishing-resistant factor. That gap matters and is worth flagging rather than filling with assumption.
- Identity takeover. The Entra account becomes the attacker's identity across every federated application it can reach.
- Lateral reach via SSO. Salesforce trusts the Entra assertion. No second compromise is required.
- Bulk export. Customer records are pulled out at volume through normal API or export functionality, producing an archive in the 1.5 GB to 2.4 GB range depending on which package is being described.
- Extortion, then leak. Listing on May 26, deadline May 27, publication after non-payment.
The AXIS analysis scores this as zero of three preventive controls holding, with the failure anchored at the authentication step. That is a reasonable reading: once step one succeeded, nothing downstream was positioned to stop the export.
What Organizations Should Do
Make help desk identity verification resistant to a persuasive caller. Credential resets and MFA re-enrollment should require an out-of-band factor the caller cannot supply by talking, such as a manager callback to a directory-of-record number or a verified device attestation. Written policy is not enough; test it with your own red team by phone.
Deploy phishing-resistant MFA on the identity provider itself. FIDO2 or certificate-based authentication on Entra breaks this chain at step one in a way that push notifications and OTP codes do not. Prioritize accounts with SSO reach into CRM, billing, and support platforms.
Instrument bulk export in your SaaS tier, not just your network. Salesforce, ServiceNow, Zendesk, and equivalents all emit API and report-export telemetry. Alert on volume anomalies (row counts far above a user's baseline, exports outside business hours, first-time use of the Bulk API by a given identity) and route those alerts somewhere staffed.
Scope SSO grants to job function. A support representative's identity should not be able to reach the full customer Account object. Enforce field-level security and record-scope restrictions so that a single compromised session yields thousands of records rather than millions.
Treat contact center and BPO staff as tier-one identity targets. They are high-turnover, high-volume, trained to be helpful, and hold broad customer data access. That combination is the campaign's preferred entry point. Extend the same conditional access, session limits, and training cadence you apply to administrators.
Get the scope characterization right before you publish it. Charter's early CPNI denial, issued while the data was still being analyzed, is now contested in court. Say what you have verified, say explicitly what is still under review, and update. For regulated data categories, coordinate the public statement with counsel and with whoever is actually reading the exfiltrated files.
For Spectrum customers: assume name, address, phone, and email are public. The realistic follow-on risk is targeted phishing and fake technical support calls that cite real account details to establish credibility. Any inbound message creating urgency should be verified by calling Spectrum through a number you looked up yourself.
Sources: Spectrum Data Breach: 4.9M Confirmed, 42M Claimed 2026 | Spectrum Breach: 4.9M Records Leaked by ShinyHunters 2026 | Charter Communications Breach (2026): The IAM Failures Behind It A... | The Spectrum Breach Started With a Phone Call: Why Your Contact Cen... | Spectrum (Charter) Data Breach Class Action Lawsuit | Spectrum Breach Exposes Vulnerability in Our Voices | DATABASE USA / charter.com (Spectrum) / American Telecommunications... | ShinyHunters Breach 275M Student Records, 42M ...