CyrusOne, LLC. Listed by ShinyHunters Ransomware Group

Your information appears in a listing made by the Shinyhunters ransomware group on their leak site. The group claims to hold 12.9 million Salesforce records belonging to CyrusOne customers, along with large volumes of SharePoint data including contracts, NDAs, physical key logs, and limited employee contact details. CyrusOne has not publicly confirmed the claim as of this writing.

What the Listing Actually Claims

According to the Shinyhunters post dated August 23, 2026, the group says it extracted more than 182,000 rows of customer data from a Salesforce “Contacts” object and over 8,300 rows of employee records. They also list thousands of executed contracts, master service agreements, non-disclosure agreements, leases, statements of work, and physical key inventory logs. The post does not name specific categories of personally identifiable information for every record, nor does it state how many individuals are affected. The company has not issued any public statement confirming or denying these claims.

Your Situation if the Claim Is Accurate

If customer records from CyrusOne were taken, the most sensitive items are the contracts, NDAs, and physical key logs. These documents often contain business relationships, pricing, security procedures, and access details that retain value long after any incident. Employee names, job titles, phone numbers, and email addresses are also listed in smaller volume.

Change it immediately on CyrusOne and on every other site where you reused it. This single step removes the most direct account-access risk.

What a Ransomware Leak-Site Listing Does and Does Not Prove

Shinyhunters, like many extortion groups, publishes victim names on leak sites to pressure payment. These postings are marketing. Some reflect real intrusions with genuine data exfiltration. Others contain recycled data from older incidents, exaggerated file counts, or entirely fabricated claims. The absence of independent verification from CyrusOne, a regulator, or a third-party forensic report means this remains an unconfirmed accusation rather than an established breach.

Real confirmation would require the company to acknowledge the incident, notify affected customers directly, or report it to regulators with specific details. Until that happens, the listing alone does not prove that an intrusion occurred, that the claimed volume of data was taken, or that the Salesforce and SharePoint material was successfully exfiltrated. It establishes only that one ransomware crew has named CyrusOne while demanding $13 million.

The Broader Ransomware Extortion Pattern

Listing companies that refuse ransom demands has become standard theater in this ecosystem. Groups frequently mix real compromised data with older dumps or inflated descriptions to increase pressure. Customers of data-center and colocation providers like CyrusOne hold valuable business contracts and operational details that remain useful for targeted follow-on attacks months or years later. The uncertainty itself creates risk: even the possibility that key logs or NDAs are circulating can affect business trust and insurance posture.

Because the filing carries no incident date, there is no reliable way to know when any potential compromise occurred. The only practical way to learn whether your specific records were included is to receive a direct notification from CyrusOne. Letters sent to your last known address are the primary channel. If you have moved since the events in question, contact the company directly to confirm your status.

Actions That Address This Specific Listing

• Review all contracts or NDAs you have with CyrusOne. If any of those documents could expose sensitive business terms, discuss updated security provisions with your own legal team.
• Monitor business email addresses associated with your CyrusOne account for unusual login attempts or phishing. The listed employee and contact data increases the chance of targeted social engineering.
• Contact CyrusOne customer support to ask whether they plan to notify affected customers. A direct response from the company remains the only authoritative source on whether your records were involved.

GalaxyWarden provides continuous monitoring across 13.1 billion breach records and more than 100 platforms, with identity-chain mapping and remediation support from specialists.