ShinyHunters hackers claim to have hit data center provider used by Microsoft and Meta

ShinyHunters adds CyrusOne to its victim list, demanding $13m ransom Claimed theft includes 12.9 million Salesforce records, 600GB SharePoint data, PII, contracts, and facility diagrams Breach could enable physical intrusions and supply‑chain attacks; CyrusOne has not commented or paid The infamous ShinyHunters ransomware crew has added CyrusOne, a major US data center operator, to its list of victims, claiming to have stolen a treasure trove of highly sensitive data which, if proven true, could turn this into a bonafide catastrophe for the company and its customers.

Overall, ShinyHunters claims to have exfiltrated 12.9 million Salesforce records, more than 182,000 rows from the Salesforce Contacts object, more than 600 GB of SharePoint data, more than 8,300 employee records containing personally identifiable information (PII), executed contracts, master service agreements, NDAs, and service agreements, data center floor plans, electrical diagrams, access-control records and badge audits, physical key inventories, security policies, critical Environment Reliability Management documentation, and various passwords and credential artifacts.

No samples have been posted just yet, but researchers don’t see it as suspicious, but rather as a pressure tactic.

What makes this attack different In exchange for deleting all of the stolen data, ShinyHunters is demanding $13 million from CyrusOne which, at this time, is not commenting on the claims, and is seemingly not interested in negotiations.

“They are refusing to pay a $13 million demand.

They have 24 hours left to engage with us.

We hold 12.9 million Salesforce records,” the attackers allegedly wrote.

Ransomware groups steal sensitive corporate data all the time, but this incident has the potential to be among the most devastating data breaches ever.

Some of the secrets that were nabbed cannot simply be changed: data center floor plans, electrical diagrams, access-control records, badge audits, physical key inventories, this kind of intelligence can be used for physical breaches.

If criminals know how keys are assigned, how the data center is organized, where surveillance cameras are located, and how guards operate, it makes it easier to physically break it.

“You can’t patch a building,” the researchers warned, noting that some of the things that can be changed, such as physical keys and access zones, still take months and “real money”, they added, hinting at just how big the problem could be.

CyrusOne runs some 50 facilities all across the United States and serves hundreds of companies and corporations.

Some of its clients include Fortune 1000 companies, as well as big tech names such as Microsoft, Meta, Verizon, AT&T, IBM, and CME Group.