Spectrum parent Charter’s data published after extortion, exposing 4.9 million email addresses
Published Charter data exposed 4.9 million unique email addresses, contact details and an employee-directory subset. Charter says its business-customer sales tools were affected. Check your email in HIBP and independently verify unexpected Spectrum messages.
Check your email address using Have I Been Pwned or Mozilla Monitor. Treat unexpected Spectrum calls, texts and emails cautiously, even if they know your contact details; verify requests through the Spectrum app or a contact number you already trust. There is no device update that removes the exposed information.
What’s happening
Charter Communications, the company behind Spectrum, confirmed a breach after ShinyHunters threatened to publish stolen information. The group later released data containing 4.9 million unique email addresses, names, telephone numbers and physical addresses, according to Have I Been Pwned. Approximately 85,000 employee-directory records also contained job titles. Charter told BleepingComputer that only sales tools covering current, former and prospective business customers were affected, and denied that sensitive personal information or protected customer network information was stolen or released. The attackers claimed an employee account was compromised on 1 April; Charter did not confirm that account of the intrusion. Mozilla Monitor instead records 23 May as the breach date and explicitly says passwords were not exposed. This is a data exposure, with no customer software patch to install. As of 3 November, the reviewed sources do not establish completed customer notification, deletion of the published data or a final investigation outcome.
- What
- Breach
- Affects
- Charter Communications / Spectrum business-customer contact data and employee directory
- Fixed in
- Nothing to patch
- Since
- 23 May 2026
- Closed
- 30 May 2026
Timeline
- Vendor revised
BleepingComputer added Charter’s follow-up statement: the company said only sales tools for current, former and prospective business customers were affected. Charter maintained that no sensitive personal information or protected customer network information was released.
- Update
BleepingComputer reported that ShinyHunters published the stolen data after Charter refused its ransom demand. The publication date itself was not specified.
- Update
Have I Been Pwned added the breach after the data was published, identifying 4.9 million unique email addresses with names, telephone numbers and physical addresses. Approximately 85,000 employee-directory records also included job titles.
- Made public
BleepingComputer published Charter’s confirmation following ShinyHunters’ extortion threat. Charter denied theft of sensitive personal information or protected customer network information; the attackers claimed they gained access on 1 April.
- UpdateNothing to patch
Mozilla Monitor records 23 May as the breach date. This differs from the attackers’ subsequently claimed 1 April intrusion date.
Sources
- Charter confirms data breach after ShinyHunters extortion threat — includes Charter’s statementBleepingComputer · 26 May 2026
- Charter Communications data breach affects 4.9 million accounts — updated with Charter’s follow-up statementBleepingComputer · 30 May 2026
- Charter Data BreachHave I Been Pwned · 28 May 2026
- Charter Data BreachMozilla Monitor · 28 May 2026