# Major Telecom Breach: ShinyHunters Gang Steals Data on 4.9 Million Charter Communications Accounts


Voice phishing attack on employee compromises Spectrum customer database; company disputes scope of sensitive data exposure


Charter Communications, the second-largest cable and telecommunications operator in the U.S., confirmed this week that it suffered a data breach affecting 4.9 million customer accounts. The breach, attributed to the ShinyHunters extortion gang and first reported by Have I Been Pwned, exposed names, email addresses, physical addresses, phone numbers, and account information for millions of Spectrum customers nationwide.


The incident underscores the escalating risk posed by targeted social engineering attacks against large enterprises, as well as the widespread vulnerability of Salesforce instances—a recurring attack vector that has impacted hundreds of organizations globally over the past 12 months.


## The Threat


On April 1, 2026, threat actors from ShinyHunters executed a voice phishing (vishing) attack that successfully compromised an employee's Microsoft Entra account. Using that initial foothold, the attackers pivoted laterally into Charter's Salesforce environment and exfiltrated approximately 42 million records according to the gang's claims.


The ShinyHunters extortion group then demanded a ransom to delete the stolen data and prevent its release. When Charter refused to pay, the gang leaked the dataset on their dark web leak site, following the standard playbook of modern ransomware-as-a-service and data theft operations.


Have I Been Pwned analyzed the leaked data and confirmed:

  • 4.9 million unique email addresses exposed
  • Customer names and physical addresses
  • Phone numbers and phone types
  • Plan and account information
  • Support ticket data
  • Approximately 85,000 records from internal employee directories, including job titles

    • ## Background and Context


    ### About Charter Communications


    Charter Communications operates the Spectrum brand, serving over 32 million customers across 57 million homes in 41 U.S. states. The company employs more than 92,000 workers and provides internet, mobile, video, and voice services to residential and business customers. As one of the nation's largest telecommunications providers, Charter represents a high-value target for cybercriminals seeking bulk customer data.


    ### ShinyHunters' Campaign Against Salesforce


    ShinyHunters has emerged as one of the most prolific threat groups targeting enterprise SaaS platforms. Over the past year, the gang has:


  • Breached hundreds of organizations using Salesforce
  • Claimed the theft of billions of records from Salesforce instances
  • Targeted companies across multiple industries, including retail, finance, healthcare, and technology
  • Executed a parallel campaign against Salesloft and Drift customers

    • The group's repeated success against Salesforce customers suggests either systematic weaknesses in how enterprises configure their Salesforce security, widespread credential compromise among employees, or both.


    ### Charter's Official Response


    Charter told BleepingComputer: *"No sensitive personal information (PI) or customer proprietary network information (CPNI) data was exfiltrated by the threat actor as a result of recent activity."*


    However, this statement conflicts with the ShinyHunters gang's public claims that they also accessed CPNI data (Customer Proprietary Network Information—a regulated category that includes phone records and call history). The discrepancy raises questions about either the completeness of Charter's incident investigation, the scope of what the company classifies as "sensitive," or the validity of the attackers' claims. BleepingComputer's follow-up inquiry about CPNI was not answered with additional detail.


    ## Technical Details


    ### Attack Vector: Voice Phishing


    The initial compromise began with a vishing attack—a social engineering technique using phone calls to manipulate employees into divulging credentials or performing actions that compromise security.


    The attacker(s) called a Charter employee, impersonated a trusted contact or authority figure, and successfully convinced them to either:

  • Share login credentials
  • Click a malicious link and enter credentials
  • Approve an unusual Microsoft Entra authentication request

    • This approach bypasses many technical controls because it exploits human psychology rather than software vulnerabilities. Even organizations with multi-factor authentication (MFA) enabled can fall victim if the attacker convinces the user to approve an MFA prompt on their device.


    ### Lateral Movement and Data Exfiltration


    Once the employee account was compromised, the attackers:

    1. Accessed the internal network using legitimate credentials

    2. Discovered and accessed Salesforce instance(s) used by Charter's customer service and sales teams

    3. Extracted 42 million records containing customer and employee data

    4. Staged the data for exfiltration to external infrastructure controlled by ShinyHunters


    No encryption or data loss prevention (DLP) tools apparently stopped the exfiltration, or they were either not configured or not effective against this particular lateral movement pattern.


    ## Implications for Telecommunications and Other Industries


    ### Regulatory and Compliance Risk


    CPNI regulations (enforced by the FCC for telecom carriers) restrict how telephone companies handle customer call records and related information. If CPNI data was indeed stolen—as ShinyHunters claims—Charter could face:

  • FCC investigations and fines
  • State attorney general actions
  • Class-action lawsuits from affected customers
  • Mandatory security audit requirements

    • The contradiction between Charter's statement and ShinyHunters' claims may take months to resolve through forensic investigation.


    ### Broader Telecom Sector Vulnerability


    This is not an isolated incident. Charter has also been compromised by Salt Typhoon, a Chinese state-backed threat group that has targeted AT&T, Verizon, Consolidated Communications, Windstream, Lumen, and telecom companies in dozens of other countries. This suggests the telecom sector faces simultaneous threats from:

  • Financially-motivated cybercriminals (ShinyHunters, other extortion gangs)
  • Nation-state actors (Salt Typhoon, others) conducting espionage

    • ### Salesforce as a Persistent Attack Surface


    The repeated targeting of Salesforce instances across hundreds of organizations indicates that:

  • Default configurations may be insecure or poorly understood by many organizations
  • Credential sharing or weak password practices remain common
  • Insufficient segmentation allows attackers to move from a single compromised account to massive data repositories

    • ## Recommendations


    ### For Charter Communications and Similar Telecom Carriers


    | Control | Rationale |

    |---------|-----------|

    | Mandatory MFA for all employees | Prevents credential-only compromise; requires hardware tokens for sensitive roles |

    | User and Entity Behavior Analytics (UEBA) | Detects unusual access patterns, data exfiltration, lateral movement |

    | Real-time DLP monitoring | Alerts on bulk data downloads from Salesforce and other SaaS platforms |

    | Vishing awareness training | Monthly simulated phishing/vishing campaigns with enforcement for failures |

    | Salesforce-specific security audit | Review all user permissions, API integrations, and data access controls |

    | Privileged account monitoring | Enhanced logging and alerting for accounts with high-level access to customer data |


    ### For Organizations Using Salesforce


  • Audit all Salesforce user accounts and revoke unnecessary access
  • Enable IP whitelisting to restrict access to expected networks
  • Implement field-level encryption for sensitive customer data within Salesforce
  • Monitor and limit API usage to detect automated data exfiltration
  • Restrict administrative access and rotate admin credentials quarterly

    • ### For Customers Affected


    Individuals whose names, email addresses, and phone numbers were exposed should:

  • Monitor credit reports for fraudulent account applications
  • Expect targeted phishing and social engineering attacks
  • Verify any communications purporting to come from Charter by calling their official customer service number
  • Consider a credit freeze if address and other identifying information feels at risk

    • ---


    ## HackWire Analysis


    The Charter breach illustrates a critical gap in how enterprise security is measured and reported. The company claims "no sensitive personal information" was stolen—a technically defensible statement if we accept Charter's definition of what constitutes "sensitive"—while the attackers claim CPNI theft, and Have I Been Pwned confirmed exposure of 4.9 million email-address-to-name-and-phone combinations.


    For most individuals, this data is genuinely useful: a name, address, and phone number are the building blocks of identity fraud, SIM swaps, and social engineering attacks. Yet in the compliance framework, CPNI is a narrower category. This creates a communications vacuum where the company's reassurance feels contradicted by the exposure scope that customers can verify.


    The deeper pattern here is that vishing remains devastatingly effective even at large, security-conscious organizations. Charter has invested in MFA, incident response, and security tooling—yet a single phone call got an employee to compromise themselves. This reflects the stubborn reality that humans are the weakest link in most security architectures, and no amount of technical control can fully close that gap. Organizations must pair behavioral training with detection mechanisms that catch the inevitable compromises before they cascade into data theft at scale.


    ShinyHunters' success against Salesforce also deserves scrutiny. Hundreds of breaches, billions of records—this suggests Salesforce misconfigurations and inadequate access controls are now a systemic risk category, not a freak occurrence. Whether the problem is default-insecure configurations, poor documentation, or widely-shared exploitation knowledge is less important than the fact: if you store high-value customer data in Salesforce without rigorous access controls, assume it *will* be exfiltrated eventually.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)