ShinyHunters demand $13 million from CyrusOne after data breach

Ransom Demand and Data Scope

ShinyHunters, a notorious ransomware group, claims to have breached the data center operator CyrusOne, which services Microsoft and Meta. The attackers say they stole 12.9 million Salesforce records, 600 GB of SharePoint files, personal data, contracts and facility diagrams, demanding a $13 million ransom. The group posted screenshots of the compromised systems to prove the breach.

ShinyHunters announced the breach on a dark web forum, attaching proof of access to internal systems. They claim the stolen data includes 12.9 million Salesforce records, 600 GB of SharePoint files, employee personal information, signed contracts and floor plans of CyrusOne facilities. The ransom request stands at $13 million, with a four‑day ultimatum.

Could This Compromise Physical Security?

The breach threatens not only data confidentiality but also physical security. Facility diagrams could aid intruders in planning unauthorized entry.

Supply‑chain attacks might compromise software updates for Microsoft and Meta services hosted on CyrusOne. Experts warn that unpaid ransom could lead to further data leaks. If the ransom is not paid, the group may publish the data, disrupt services, or leverage the information for targeted attacks on the tech giants. Authorities have opened investigations, but no arrests have been reported yet.

What data did ShinyHunters claim to have stolen from CyrusOne? They say the breach exposed 12.9 million Salesforce records, 600 GB of SharePoint files, personal identifiers, contracts and facility schematics. The information was allegedly taken from CyrusOne’s internal servers before the ransom demand.

Frequently Asked Questions

Why is the four‑day deadline significant? The short window pressures CyrusOne to negotiate quickly, reducing the chance that law enforcement or backup systems can intervene. It also signals the attackers’ urgency and may force a rapid payment decision.

How might this breach affect Microsoft and Meta? If the data is leaked, attackers could impersonate employees, craft targeted phishing campaigns, or exploit proprietary contracts. Such exposure may damage the reputation of Microsoft and Meta and invite regulatory scrutiny.