Charter Communications has confirmed a major data breach affecting its Spectrum brand after refusing to meet a ransom demand from the ShinyHunters extortion group. The attackers subsequently leaked records belonging to at least 13 million individuals, along with nearly 10 million support tickets and an internal directory covering roughly 85,000 employees. The intrusion traces back to an April 1, 2026 voice phishing attack against a single employee's Microsoft Entra account.
What Happened
On April 1, 2026, ShinyHunters operators initiated a voice phishing (vishing) campaign targeting a Charter Communications employee. The social engineering attack succeeded in compromising the employee's Microsoft Entra identity, providing the threat actors with authenticated access to internal systems. After exfiltrating sizable datasets, ShinyHunters issued a ransom demand with a deadline of May 27, 2026. Charter declined to pay, and the attackers followed through by publishing portions of the stolen data. The company has publicly confirmed the incident while disputing several of the attackers' claims about what was taken.
What Was Taken
ShinyHunters initially claimed possession of between 40 and 42 million records, though Cybernews assessed the dataset likely contains substantial duplication. Have I Been Pwned independently verified approximately 4.9 million unique email addresses within the leak. Confirmed exposed data includes:
- Customer records for at least 13 million individuals, predominantly tied to Spectrum Enterprise accounts
- Nearly 10 million support tickets containing customer service correspondence
- An internal employee directory of roughly 85,000 staff, including job titles, email addresses, and some home addresses
A contested point remains whether Customer Proprietary Network Information (CPNI) was exfiltrated. Charter Communications maintains that no sensitive personal information or CPNI left its environment, while ShinyHunters claims to hold this specific category of regulated telecom data.
Why It Matters
Spectrum is one of the largest broadband and telecommunications providers in the United States, and a breach of this scale broadens the supply of telecom identity data already circulating in the criminal ecosystem. The Enterprise account focus is particularly significant: business customer data can fuel targeted Business Email Compromise (BEC) and downstream supply chain attacks against Spectrum's B2B clients. The 85,000-record employee directory, with home addresses in some cases, creates a long tail of risk for follow-on social engineering, SIM swap fraud, and physical threats against staff. The dispute over CPNI also carries regulatory weight, as CPNI is subject to FCC rules that mandate specific notification and protective obligations.
The Attack Technique
The initial access vector was voice phishing aimed at compromising a Microsoft Entra (formerly Azure AD) account. This tradecraft is consistent with ShinyHunters' recent operational pattern, which has overlapped with Scattered Spider style help-desk impersonation against cloud identity platforms. By targeting Entra directly, the attackers bypassed traditional perimeter controls and inherited whatever access rights and federated trust relationships the compromised identity held. From a single authenticated foothold, the actors were able to reach customer support systems, enterprise account databases, and internal HR directory data, suggesting either over-privileged accounts or insufficient segmentation between identity tiers.
What Organizations Should Do
- Harden help-desk and IT support workflows against voice-based identity verification attacks by requiring out-of-band callbacks, video verification, or manager approval before any credential or MFA reset.
- Enforce phishing-resistant MFA (FIDO2 security keys, certificate-based authentication) across all Entra ID accounts, prioritizing privileged, helpdesk, and customer-data-adjacent identities.
- Apply Conditional Access policies that restrict sensitive application access to compliant devices and known network locations, and implement session risk policies to detect token replay.
- Audit Entra ID role assignments and application permissions to enforce least privilege, and review break-glass account usage and global admin counts.
- Hunt for ShinyHunters indicators including anomalous OAuth consent grants, mass data export activity from CRM and ticketing systems, and unusual sign-ins from VPN or residential proxy infrastructure.
- Notify and protect downstream customers, particularly Spectrum Enterprise account holders, by issuing heightened vigilance advisories for targeted phishing and BEC attempts referencing legitimate ticket data.
Sources: Spectrum Data Breach Exposes 13 Million Customer Records After Ransom Refusal