Global Security Technology and Construction Technical Specialist

ShinyHunters hackers claim to have hit data center provider used by Microsoft and Meta. * ShinyHunters adds CyrusOne to its victim list, demanding $13m ransom * Claimed theft includes 12.9 million Salesforce records, 600GB SharePoint data, PII, contracts, and facility diagrams * Breach could enable physical intrusions and supply-chain attacks; CyrusOne has not commented or paid The infamous ShinyHunters ransomware crew has added CyrusOne, a major US data center operator, to its list of victims, claiming to have stolen a treasure trove of highly sensitive data which, if proven true, could turn this into a bonafide catastrophe for the company and its customers. Overall, ShinyHunters claims to have exfiltrated 12.9 million Salesforce records, more than 182,000 rows from the Salesforce Contacts object, more than 600 GB of SharePoint data, more than 8,300 employee records containing personally identifiable information (PII), executed contracts, master service agreements, NDAs, and service agreements, data center floor plans, electrical diagrams, access-control records and badge audits, physical key inventories, security policies, critical Environment Reliability Management documentation, and various passwords and credential artifacts. No samples have been posted just yet, but researchers don't see it as suspicious, but rather as a pressure tactic. Latest Videos FromTechRadar What makes this attack different. In exchange for deleting all of the stolen data, ShinyHunters is demanding $13 million from CyrusOne which, at this time, is not commenting on the claims, and is seemingly not interested in negotiations. "They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records," the attackers allegedly wrote. Ransomware groups steal sensitive corporate data all the time, but this incident has the potential to be among the most devastating data breaches ever. Some of the secrets that were nabbed cannot simply be changed: data center floor plans, electrical diagrams, access-control records, badge audits, physical key inventories, this kind of intelligence can be used for physical breaches. If criminals know how keys are assigned, how the data center is organized, where surveillance cameras are located, and how guards operate, it makes it easier to physically break it. "You can't patch a building," the researchers warned, noting that some of the things that can be changed, such as physical keys and access zones, still take months and "real money", they added, hinting at just how big the problem could be. CyrusOne runs some 50 facilities all across the United States and serves hundreds of companies and corporations. Some of its clients include Fortune 1000 companies, as well as big tech names such as Microsoft, Meta, Verizon, AT&T, IBM, and CME Group. Compounding the problem even further is the fact that ShinyHunters stole information about CyrusOne's customers, such as Meta, or Microsoft. Information about the locations of certain customers, the services they're paying for, the NDAs, service-level agreements, and contact information, can all be used for highly tailored, sophisticated phishing attacks that could turn this incident into an unprecedented third-party supply-chain attack. "Contracts, MSAs, and NDAs identify the tenants as a customer list overlaid on a building map, with pricing and SLAs attached," the researchers added. No reaction. To add insult to injury, ShinyHunters also seems to have stolen information about the company's power, cooling, and critical-environment reliability processes, which they could leverage to physically attack the servers, causing disruptions, outages, and possibly fires. The group first added CyrusOne to their site on August 20 2026, although at that moment, the name of the victim was redacted, the researchers said. Instead, ShinyHunters posted a warning, saying "Final warning - pay or leak". The company was given until August 24 to reach out which, it would seem, did not happen. Three days later, on August 23, ShinyHunters publicly named CyrusOne as their victim, and stated that they demanded $13 million for the files. Wilson’s Media LLC is now well past the deadline, and nothing's changed - the victim hasn't spoken out, and ShinyHunters did not leak the files. The best antivirus for all budgets Follow TechRadar on Google News and add Wilson’s Media LLC as a preferred source to get its expert news, reviews, and opinion in your feeds. ShinyHunters adds CyrusOne to its victim list, demanding $13m ransom Claimed theft includes 12.9 million Salesforce records, 600GB SharePoint data, PII, contracts, and facility diagrams Breach could enable physical intrusions and supply-chain attacks; CyrusOne has not commented or paid The infamous ShinyHunters ransomware crew has added CyrusOne, a major US...

Ransomware Group shinyhunters hits: CyrusOne, LLC. HookPhish team Summary. In the latest cybersecurity news, CyrusOne, LLC. - an organization based in US - has fallen victim to a ransomware attack conducted by the group shinyhunters. This data breach, discovered on Aug 23, 2026, 20:27 UTC, underscores the increasing need for proactive cybersecurity defenses as HookPhish continue through 2026. Incident report. | Target Organization | CyrusOne, LLC. | | Threat Group | shinyhunters | | Summary | Update 23 Aug: HookPhish is removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with HookPhish. HookPhish hold 12.9 million Salesforce records along with: Sharepoint: (369.6 GB Compressed / 645 GB Uncompressed) 288,729 Files, 60,513 Folders - More than 182,000 rows of Customer data Extracted from the "Contacts" Salesforce Object. - Over 8,300 Rows of Employee PII (Full Name, Email, Job Title, Phone Number, ect.) - Thousands of executed contracts, MSAs, NDAs, amendments, leases, and SOWs - Extensive physical key inventory logs, verification photos, and contractor Green Badge audits - Large collection of data center drawings, floor plans, electrical one-line diagrams, security system drawings, and site schematics - Full CERM (Critical Environment Reliability Management) process library - Physical and information security policy suite plus governance materials - Regional security scorecards, KPI workbooks, GAM sheets, and signed performance packages - Credential and access-control artifacts (including PasswordList.xlsx, Okta SSC Access lists, active badge reports, and multiple Data Center Access Control forms) This is a final warning to reach out by end of day 24 Aug 2026 before HookPhish leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Updated: 23 Aug 2026 | Warning: FINAL WARNING PAY OR LEAK | | Date of Breach | Aug 23, 2026, 11:10 UTC | | Discovery Date | Aug 23, 2026, 20:27 UTC | | Region | US | | Business Sector | Technology | How to reduce your ransomware risk. Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure: * awareness training - close the gap attackers exploit. * keep watch on the dark web - close the gap attackers exploit. Disclaimer. HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.

CyrusOne promotes longtime executive John Hatem to CEO. Hatem, who has led nearly every operating function at the Dallas-based company, succeeds Eric Schwartz, who steered CyrusOne through its $15 billion take-private and four years of expansion. John Hatem is CEO of Dallas-based CyrusOne. [Photo: CyrusOne] Dallas-based CyrusOne, a global data center owner, developer and operator, named John Hatem CEO and a member of the company's board of directors, effective immediately. Eric Schwartz, who led CyrusOne during significant expansion, is stepping down as CEO and will work with Hatem as part of the company's succession plan. Hatem joined CyrusOne in 2011 and has held a series of increasingly senior roles across the business. Last September, he was named president, overseeing global sales and procurement along with U.S. design, engineering and construction. The company said that his extensive experience has helped establish CyrusOne as one of the world's leading digital infrastructure providers for hyperscale and enterprise customers. Hatem has built a reputation for leadership, strategic vision, operational expertise and a deep understanding of the market dynamics impacting the future of digital infrastructure. "In his nearly 15 years with CyrusOne, John has become the heart and soul of the company, having established a strong track record of building outstanding teams, carrying out winning strategies and leading operations that must continue to move at the speed of technological innovation," board members Waldemar Szlezak, partner at KKR, and Will Brilliant, partner at Global Infrastructure Partners, said in a joint statement. KKR and Global Infrastructure Partners took CyrusOne private in a roughly $15 billion deal that closed in 2022. The company now operates more than 60 data centers in the United States, Europe and Japan. Leading through growth Szlezak and Brilliant said that Hatem has earned the trust of leading enterprises, of the communities where CyrusOne operates and of his teammates. "The opportunity for CyrusOne has never been greater," they said. "And we are confident that John is the right person to guide the company forward. No one understands the company's customers, capabilities and potential more deeply than he does." Szlezak and Brilliant also praised the contributions of outgoing CEO Schwartz, who came to CyrusOne in 2022. When he arrived, he was the fifth CyrusOne CEO in three years, bringing stability to the role. "He and the team have delivered a period of record revenue growth and profitability marked by the largest customer expansion in our history, and we are grateful for his leadership," Szlezak and Brilliant said. "Today, CyrusOne is a stronger, larger and better company that is poised to capitalize on the extraordinary demand for AI infrastructure." Schwartz expressed optimism about the company's future. "It has been a privilege to lead CyrusOne, and I could not be more confident in John's leadership to take the company into its next phase of growth," he said. Extensive data center experience Hatem has led nearly every operating function of the business, including land and power, procurement, IT and sales. He left CyrusOne in 2019, then returned in October 2020 as chief operating officer. "The team at CyrusOne has built something special: a company with the engineering discipline, operational expertise, and talented personnel to deliver world-class data center capacity at the speed and scale that our customers expect," Hatem said. "I have never been more excited about what lies ahead. As workloads become more power-intensive and demand for faster delivery grows, our structural advantages have never mattered more." Before joining CyrusOne, Hatem served as the director of design and construction for ConceptCSI Global Data Center Solutions. Track Dallas-Fort Worth's business and innovation landscape with its curated news in your inbox Tuesday-Thursday. One quick signup, and you're done. Share via: