Data Center Giant CyrusOne Hit by Massive ShinyHunters Hack

The infamous ShinyHunters ransomware crew has claimed CyrusOne, a major US data center operator, as a victim, alleging the theft of extensive and sensitive data. The group is demanding $13 million for the deletion of the exfiltrated information. This breach includes over 12.9 million Salesforce records and 600GB of SharePoint data. The stolen information is critically concerning because it contains facility diagrams, electrical schematics, and access control records.

This intelligence could enable attackers to bypass physical security measures, posing a severe threat to the data center's infrastructure and its clients. CyrusOne operates around 50 facilities nationwide, serving numerous Fortune 1000 companies and major tech firms like Microsoft and Meta. The attackers also allegedly obtained customer data, including contracts and service agreements, which could facilitate highly targeted phishing campaigns and supply-chain attacks.

ShinyHunters initially issued a warning on August 20, 2026, with a deadline of August 24. On August 23, they publicly named CyrusOne and reiterated their $13 million demand. As of August 26, 2026, CyrusOne has not publicly commented on the incident, and the stolen data has not yet been leaked, though researchers note this could be a pressure tactic. The stolen data also reportedly includes details about power and cooling systems, potentially enabling physical sabotage.