Inter-Con Security: ShinyHunters Pay-or-Leak Extortion Leak

"Inter-Con Security Systems, a Pasadena-based multinational private security contractor that supplies armed and unarmed officers, executive protection and risk management to government, corporate and critical…"

Inter-Con Security Systems, a Pasadena-based multinational private security contractor that supplies armed and unarmed officers, executive protection and risk management to government, corporate and critical infrastructure clients, has been named as the victim of a ShinyHunters "pay or leak" extortion campaign. The leaked dataset indexed by Have I Been Pwned contains 276,114 unique email addresses (HookPhish, citing the HIBP feed) alongside names, physical addresses, job titles, employers and phone numbers. ShinyHunters itself claimed a far larger haul: roughly 2.7 million records, according to the notice published by law firm Schubert Jonckheer & Kolbe. Readers should note the sourcing floor here. There is no victim statement, no regulator filing text and no national CERT advisory in the record below. Every account of this incident traces back either to the attacker's own claim or to a third-party breach feed, and Inter-Con has not publicly confirmed the incident.

What Happened

The timeline as reconstructed from the available reporting is consistent in shape but not in detail. ClaimDepot dates the underlying intrusion to a ransomware attack on 5 June 2026, with ShinyHunters posting its claim to a Tor leak site on 18 June 2026. The Schubert Jonckheer & Kolbe privacy alert dates the public claim to 19 June 2026. HookPhish, drawing on the Have I Been Pwned entry, records the breach date as 18 June 2026 against the domain icsecurity.com. Accounts differ by roughly a day on the leak-post date, which is normal for Tor-site monitoring, but the underlying compromise date of 5 June is asserted by a single OTHER-tier source and should be treated as unconfirmed.

The extortion model is the salient part. UnderCode News, summarising the HIBP notification, describes a pay-or-leak sequence: data stolen first, ransom demanded second, publication when negotiations failed or fell short of the attackers' expectations. This is the now-dominant ShinyHunters pattern, in which encryption is optional and the leverage is entirely reputational and regulatory.

On the disclosure side, ClaimDepot reports that the breach was reported to the Indiana Attorney General on 23 June 2026 and lists disclosures filed with the California, Iowa, Maine, Massachusetts, Montana, Nebraska and New Hampshire regulators. We have not seen the underlying filings, so the substance of what Inter-Con told those regulators is not established here. What is established across two independent sources is that as of mid-July 2026 Inter-Con had not publicly confirmed the incident, had not published a response, and had not, per the plaintiffs' firm, notified affected individuals. That firm argues the silence may itself violate federal or state notification law. That is a litigant's characterisation, not a regulatory finding, and it comes from a party with a commercial interest in the case.

What Was Taken

The record counts diverge by an order of magnitude, and the divergence is not noise. It reflects two different measurements.

The HIBP-derived figure is 276,114 compromised accounts, described consistently by UnderCode News and HookPhish as approximately 276,000 unique email addresses. That is a deduplicated count of distinct addresses in the published dump. The attacker's claim, reported by Schubert Jonckheer & Kolbe via PR Newswire and syndicated by Morningstar, is approximately 2.7 million records affecting approximately 2.7 million individuals. Records are not people and are not unique addresses, so a dataset containing 2.7 million rows collapsing to 276,000 distinct emails is arithmetically unremarkable. What matters for defenders is that the smaller number is the one actually verified against published data, and the larger number is an unverified attacker assertion that a law firm has repeated as an individual count.

Field-level content is likewise split. The HIBP-sourced description covers email addresses, names, physical addresses, job titles, employers and phone numbers, drawn from a mix of contacts, internal users and sales leads. That composition matters: a leads-and-contacts blend points toward CRM-shaped data rather than an HR system. ClaimDepot separately lists a much more sensitive set including Social Security numbers, dates of birth, government IDs, medical information and financial information, while simultaneously stating that affected information types have not yet been disclosed. Those two statements sit in the same page and contradict each other. Treat the sensitive-field list as unconfirmed template content until a regulator filing or notification letter substantiates it. The Schubert alert describes the exposure more generally as PII belonging to current and former employees, security personnel and clients, plus internal corporate data.

For a company whose business is physically protecting government facilities and critical infrastructure, the identity of the people in the file is arguably more consequential than the field list. Names, employers, job titles and phone numbers for security personnel and their government and corporate clients constitute a targeting package, not just an identity-theft risk.

Why It Matters

Three things make this brief worth filing beyond the raw numbers.

First, the victim is a security provider. Contractors that guard facilities hold rosters, post assignments, client relationships and personnel details whose exposure creates downstream physical and operational risk for organisations that are not themselves breached. Any entity that has contracted Inter-Con should be treating this as a third-party incident affecting its own personnel data, regardless of what Inter-Con eventually confirms.

Second, the disclosure vacuum is the story. Six weeks after the leak, the authoritative public description of this breach comes from a threat-intelligence feed and a class-action firm. When a victim does not speak, the attacker's number becomes the headline number, and 2.7 million is now the figure circulating in syndicated financial media. That asymmetry is itself part of the extortion leverage.

Third, this is one entry in a sustained ShinyHunters campaign. SecurityWeek places the recent wave alongside the University of Nottingham, DentaQuest, 7-Eleven, Medtronic and Wynn Resorts, and its read is that these intrusions are not perimeter failures. They are identity failures.

The Attack Technique

No source establishes the initial access vector for Inter-Con specifically. ClaimDepot characterises the incident as a ransomware attack; the HIBP-derived reporting describes pure data theft and extortion with no mention of encryption. Those are different incident types, and the sources genuinely conflict. Nothing in the available record resolves it.

What can be stated is the group's established tradecraft, which is documented by better sources than anything covering the Inter-Con intrusion itself. RH-ISAC, summarising Microsoft research published on 13 July 2026, describes a ShinyHunters campaign running from mid-2025 through mid-2026 against SaaS applications, especially Salesforce, using vishing, supply chain compromise and misconfigured guest access, then abusing trusted OAuth relationships for access, exfiltration and persistence. The critical detection problem RH-ISAC flags is that the malicious activity was frequently indistinguishable from legitimate Salesforce usage, because it ran through trusted identities, approved OAuth applications and authorised integrations.

Mitiga's analysis of the same activity, which it tracks as UNC6040 and distinguishes from the separate UNC6395 Salesloft Drift campaign, documents the mechanism in detail: the attacker configures OAuth device flow against a local Salesforce Data Loader instance, generates an eight-character code, then vishes an English-speaking employee while impersonating IT support and walks them through entering that code on Salesforce's legitimate verification page. Approval issues an access token to the attacker's Data Loader, and every subsequent action executes as the victim.

SecurityWeek's broader list of observed techniques across the campaign wave includes infostealer-harvested credentials, MFA fatigue and vishing, compromised SaaS integrations, OAuth token abuse, excessive cloud application permissions, misconfigured guest access, third-party trust exploitation and help desk impersonation. Its framing is blunt: these actors do not break in, they log in. Salesforce's position on the Experience Cloud campaign, per SecurityWeek, was that overly permissive guest-user configuration was the root cause rather than a platform vulnerability.

The one weak circumstantial link to Inter-Con is the leaked data's composition. A file blending contacts, internal users and leads is the shape of a CRM export, which is consistent with the group's SaaS-centric pattern. That is an inference, not a finding.

What Organizations Should Do

Inventory and prune OAuth-connected applications in Salesforce and every other SaaS tenant. RH-ISAC's specific recommendation is to identify applications inactive for 90 days or more and revoke their access, since one-time and temporary integrations retain their permissions indefinitely after everyone forgets them.
Score connected apps by risk. Assign each application a numerical rating based on usage pattern, permission sensitivity and behavioural signals, then build alerting policies against those thresholds so review effort lands where it matters.
Harden the help desk against voice social engineering. The device-code flow Mitiga documents fails only if an employee refuses to enter an attacker-supplied code. Mandate out-of-band callback verification for any request involving codes, MFA resets or access approvals, and train staff that a legitimate verification page does not make the request legitimate.
Audit guest-user and public-portal configuration. Both SecurityWeek and RH-ISAC identify misconfigured guest access as a repeated entry point, and it is a configuration problem you can close without vendor involvement.
Enable and actually monitor SaaS event logging. Because this activity looks like normal usage, detection depends on volume and behavioural anomalies in Salesforce event monitoring, not on signatures. Alert on bulk export patterns and Data Loader activity from unusual sources.
If you contract Inter-Con or a comparable security provider, open a third-party inquiry now rather than waiting for notification. Ask specifically which of your personnel and site data sat in their CRM, and brief affected staff that names, employers, job titles and phone numbers in this dataset are directly usable for targeted phishing and pretexting.

Sources: ShinyHunters Allegedly Targets Inter-Con Security in Pay-or-Leak Ex... | What the Latest ShinyHunters Breaches Reveal About Modern Cyberatta... | PRIVACY ALERT: Inter-Con Security Systems, Inc. Under Investigation... | Inter-Con Security Data Breach Potentially Compromised ... | PRIVACY ALERT: Inter-Con Security Systems, Inc. Under ... | Critical Alert: Recent Inter-Con Security Data Breach | RH-ISAC
ShinyHunters Abusing OAuth to Compromise SaaS Apps - RH-... | ShinyHunters and UNC6395: Inside the Salesforce ...