Charter Communications has confirmed a data breach affecting approximately 4.9 million customer accounts. The breach, attributed to the ransomware group ShinyHunters, began in April 2026, and involves the exposure of email addresses, names, phone numbers, and physical addresses. The incident underscores the growing threat of ransomware attacks targeting large organizations and the persistent risk of social engineering tactics.

Attackers initially gained access to Charter’s systems through voice phishing (vishing), successfully compromising a Microsoft Entra account. This initial breach allowed them to pivot to a Salesforce instance. ShinyHunters subsequently demanded a ransom, which Charter Communications declined to pay.

While ShinyHunters initially claimed to have stolen 42 million records, analysis of the leaked data verified the exposure of 4.9 million unique accounts. In addition to personal contact information, the breach also exposed 85,000 records from Charter’s internal employee directory. Charter has stated that no sensitive personal information (PI) or customer proprietary network information (CPNI) data was exfiltrated.

The ransomware group set a ransom deadline for May 27, 2026, after which they threatened to release the stolen data. Charter has alerted authorities and is working to mitigate the breach’s impact. The incident serves as a stark reminder for organizations to bolster their security posture, particularly in the face of increasingly sophisticated social engineering attacks and the potential for lateral movement within their systems.

The breach underscores the importance of multi-factor authentication and employee training to prevent vishing attacks. Organizations should also regularly review access controls and implement robust network segmentation to limit the potential impact of a successful breach. Have I Been Pwned lists the exposed data as confirmed.

Charter Communications is actively investigating the incident and working with cybersecurity experts to strengthen its defenses. Customers are advised to remain vigilant for phishing attempts and to review their account statements for any unauthorized activity. This incident highlights the ongoing challenges organizations face in protecting sensitive data from increasingly sophisticated cyber threats.

Sources:

• hothardware.com
• sqmagazine.co.uk
• bleepingcomputer.com
• techlicious.com
• cyberinsider.com
• techradar.com