{"id":"charter-spectrum-data-extortion-may-2026","category":"breach","status":"closed","title":"Spectrum parent Charter’s data published after extortion, exposing 4.9 million email addresses","tldr":"Published Charter data exposed 4.9 million unique email addresses, contact details and an employee-directory subset. Charter says its business-customer sales tools were affected. Check your email in HIBP and independently verify unexpected Spectrum messages.","summary":"Charter Communications, the company behind Spectrum, confirmed a breach after ShinyHunters threatened to publish stolen information. The group later released data containing 4.9 million unique email addresses, names, telephone numbers and physical addresses, according to Have I Been Pwned. Approximately 85,000 employee-directory records also contained job titles. Charter told BleepingComputer that only sales tools covering current, former and prospective business customers were affected, and denied that sensitive personal information or protected customer network information was stolen or released. The attackers claimed an employee account was compromised on 1 April; Charter did not confirm that account of the intrusion. Mozilla Monitor instead records 23 May as the breach date and explicitly says passwords were not exposed. This is a data exposure, with no customer software patch to install. As of 3 November, the reviewed sources do not establish completed customer notification, deletion of the published data or a final investigation outcome.","action":"Check your email address using Have I Been Pwned or Mozilla Monitor. Treat unexpected Spectrum calls, texts and emails cautiously, even if they know your contact details; verify requests through the Spectrum app or a contact number you already trust. There is no device update that removes the exposed information.","product":"Charter Communications / Spectrum business-customer contact data and employee directory","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["charter","spectrum","data-breach","extortion","shinyhunters"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Charter confirms data breach after ShinyHunters extortion threat — includes Charter’s statement","url":"https://www.bleepingcomputer.com/news/security/charter-confirms-data-breach-after-shinyhunters-extortion-threat/","by":"BleepingComputer","date":"2026-05-26"},{"kind":"news","title":"Charter Communications data breach affects 4.9 million accounts — updated with Charter’s follow-up statement","url":"https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/","by":"BleepingComputer","date":"2026-05-30"},{"kind":"research","title":"Charter Data Breach","url":"https://haveibeenpwned.com/Breach/Charter","by":"Have I Been Pwned","date":"2026-05-28"},{"kind":"advisory","title":"Charter Data Breach","url":"https://monitor.mozilla.org/en-GB/breach-details/Charter","by":"Mozilla Monitor","date":"2026-05-28"}],"started":"2026-05-23","closed":"2026-05-30","created":"2026-11-03T20:29:32.026Z","updated":"2026-11-03T20:29:32.026Z","cve_notes":[],"timeline":[{"at":"2026-05-30","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"BleepingComputer added Charter’s follow-up statement: the company said only sales tools for current, former and prospective business customers were affected. Charter maintained that no sensitive personal information or protected customer network information was released.","url":"https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/","by":"BleepingComputer","patch":null},{"at":"2026-05-29","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"BleepingComputer reported that ShinyHunters published the stolen data after Charter refused its ransom demand. The publication date itself was not specified.","url":"https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/","by":"BleepingComputer","patch":null},{"at":"2026-05-28","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Have I Been Pwned added the breach after the data was published, identifying 4.9 million unique email addresses with names, telephone numbers and physical addresses. Approximately 85,000 employee-directory records also included job titles.","url":"https://haveibeenpwned.com/Breach/Charter","by":"Have I Been Pwned","patch":null},{"at":"2026-05-26","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"BleepingComputer published Charter’s confirmation following ShinyHunters’ extortion threat. Charter denied theft of sensitive personal information or protected customer network information; the attackers claimed they gained access on 1 April.","url":"https://www.bleepingcomputer.com/news/security/charter-confirms-data-breach-after-shinyhunters-extortion-threat/","by":"BleepingComputer","patch":null},{"at":"2026-05-23","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Mozilla Monitor records 23 May as the breach date. This differs from the attackers’ subsequently claimed 1 April intrusion date.","url":"https://monitor.mozilla.org/en-GB/breach-details/Charter","by":"Mozilla Monitor","patch":"na"}],"url":"https://hard.fyi/live/charter-spectrum-data-extortion-may-2026/","json":"https://hard.fyi/api/live?id=charter-spectrum-data-extortion-may-2026"}