Zero Radar
← feed
MediumData breachHIBP-CyrusOneupdated 25 Oct 2026, 13:32 UTC

CyrusOne data centre operator: 373k contact records leaked by extortion group

A group tried to extort data centre operator CyrusOne and then published records it says it stole. The leaked data is mostly business contact details, which could be used for phishing and scam calls.

Official source
SeverityMediumData breach
Being exploited?UnclearNo reports either way yet
What to doCheck exposureTreat unsolicited messages that mention CyrusOne or your account details as possible phishing and verify them before acting.
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1ShinyHunters groupTargets CyrusOne with extortion demand
  2. 2Data takenCorporate contact data and support tickets
  3. 3Pay or leak demandThreatens to publish stolen records
  4. 4Data published373k email addresses exposed online
  5. ResultContact records exposed for phishing use

What happened

In August 2026 the ShinyHunters group ran a 'pay or leak' extortion attempt against CyrusOne and later published allegedly stolen data covering 373k unique email addresses across users, sales leads and employees.

Why it is dangerous: Names, job titles, phone numbers, physical addresses, email addresses and support tickets can be used for targeted phishing and social engineering, especially against CyrusOne customers, staff and sales contacts.

Are you affected?

You are affected if you are a CyrusOne user, sales lead or employee whose contact details were included in the published data.

Package / productAffected versionsFixed in
cyrusone.comsee advisoryno fix yet

What to do

  1. Be wary of unexpected emails, calls or messages that reference CyrusOne, support tickets or your job role, and verify requests through known contacts.
  2. Change passwords and enable multi-factor authentication on any accounts that use the same email address.
  3. Check the Have I Been Pwned service to see whether your email address appears in this breach.

Timeline

  1. 7 Oct 2026, 23:19 UTC
    Publicly disclosed
  2. 7 Oct 2026, 23:19 UTC
    Reported by Have I Been Pwned · Have I Been Pwned

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
HIBP-CyrusOne
Disclosed
7 Oct 2026, 23:19 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

CyrusOne data centre operator: 373k contact records leaked by extortion group · Zero Radar