ShinyHunters has dumped the personal details of 4.9 million Charter Communications customers after the telecom giant refused to meet the extortion crew's ransom demands. Names, email addresses, phone numbers, and physical addresses are now circulating on the dark web — and the data is already being weaponised for phishing attacks.

The breach comes in the same week ShinyHunters claimed a separate 6-million-record theft from Carnival Corporation, the world's largest cruise operator. These back-to-back disclosures reveal an attacker that is operating at industrial scale, targeting major US corporations and dumping stolen customer data when payments are not made.

Charter Communications, which offers broadband, cable TV, and phone services to millions of US households through its Spectrum brand, confirmed it is investigating the incident but disputed the sensitivity of the data exposed. The company said "no sensitive personal information (PI) or customer proprietary network information (CPNI) data was exfiltrated." That may be technically true — but millions of names, addresses, phone numbers, and emails are still a goldmine for scammers, phishers, and identity thieves.

Here is what we know about the breach, what data was actually stolen, and the exact steps you need to take right now to protect your accounts.

What Happened in the Charter Communications Breach

ShinyHunters first listed Charter on its dark-web leak site earlier in May 2026, claiming to have stolen more than 42 million records belonging to consumer and business customers. The extortion crew issued a final warning to Charter with a 27 May 2026 deadline:

"Over 42M records containing PII have been compromised. This is a final warning to reach out by 27 May 2026 before we leak along with several annoying (digital) problems that'll come your way."

When Charter did not pay, ShinyHunters followed through. The criminals updated their leak site with a statement: "Over 42M records containing PII have been compromised. The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care."

What Data Was Actually Stolen

The leaked dataset has been verified by Have I Been Pwned, which confirms the breach exposed the personal details of 4.9 million Charter customers. The confirmed data includes:

• Names — full customer names
• Email addresses — personal email accounts linked to Charter services
• Phone numbers — home and mobile numbers
• Physical addresses — street addresses associated with billing and service provision

A smaller subset of approximately 85,000 records originated from an internal staff directory and also contained job titles, providing a valuable targeting dataset for business email compromise scammers.

It is worth noting the discrepancy between the 42 million records ShinyHunters claimed and the 4.9 million confirmed by Have I Been Pwned. The lower number likely represents unique individuals after deduplication — Charter may have had multiple records per customer (billing address, service address, separate contact email) that inflated the raw count. However, both figures represent an enormous data leak.

ShinyHunters: The Most Prolific Extortion Group of 2026

This is the third major breach by ShinyHunters covered on BestPasswordGenerator.org in the last month alone. The group has been on an extraordinary run:

• Canvas/Instructure — 275 million student and faculty records stolen from the education platform, with the parent company reportedly paying between $5 million and $30 million to ShinyHunters after the attackers defaced Canvas login pages during final exam season
• Carnival Corporation — 6 million customer records exfiltrated from the cruise operator, confirmed just hours before the Charter leak
• Charter Communications — 4.9 million customer records dumped publicly after the company refused to pay

ShinyHunters has also been associated with "The Com" — a loosely knit group of primarily English-speaking hackers, SIM swappers, and extortionists who have been linked to data sales on criminal forums going back years. The group typically gains access through voice phishing and social engineering, often impersonating IT personnel to trick employees into handing over credentials.

The Verizon 2026 DBIR found that the human element was involved in 62% of all breaches — and ShinyHunters' track record is a textbook example. They do not break encryption or hack firewalls. They trick people into letting them in.

Why This Breach Matters for Your Passwords

Even though Charter says no passwords or financial data were stolen, this breach creates cascading risks for every affected customer. Here is why you need to act now.

Credential Stuffing and Password Reuse

ShinyHunters now has your name, email address, home address, and phone number. If you use Charter/Spectrum for your login credentials — or if you use the same password across multiple accounts — attackers can try those credentials on your banking, email, and social media accounts. This automated attack technique, called credential stuffing, has surged more than 1,200% in 2026 and is the single most common account takeover method. Our complete guide to credential stuffing explains exactly how it works and why password reuse is the most dangerous habit you can have.

Targeted Phishing Using Real Personal Data

Attackers now have your name, email, phone number, and physical address — four data points that make phishing lures almost impossible to distinguish from legitimate company communications. Expect emails claiming to be from "Spectrum Security" or "Charter Customer Support" that reference your real address, your real phone number, or your real account details.

This is exactly the same playbook ShinyHunters used after the Canvas breach. Security experts at Halcyon warned of "targeted phishing waves against staff, students, and parents over the next six to 12 months using leaked names, email addresses, and chat context" following that data dump. The same pattern applies here — expect Charter-themed phishing in the coming days and weeks. Our guide on phishing awareness and detection covers how to spot these lures.

SIM Swapping and Account Takeover

With your phone number and email address in the same leak, criminals have the two key pieces needed for SIM swapping — porting your phone number to a SIM they control. Once they control your number, they can intercept SMS-based two-factor authentication codes, password reset links, and bank verification calls. Charter customers should contact their mobile provider immediately to set up a SIM swap PIN or port-out passcode.

What to Do Right Now: 5-Step Action Plan

Step 1: Check If Your Data Is in the Breach

Visit Have I Been Pwned and enter every email address you use. The Charter breach has been indexed and will flag affected accounts immediately. If your email appears, move to Step 2 without delay.

Step 2: Change Your Charter/Spectrum Account Password

Even if the breach did not expose passwords, change yours immediately as a precaution. Use our free password generator to create a strong, unique password of at least 16 characters with a mix of uppercase, lowercase, numbers, and symbols. Never reuse this password on any other account. If you manage passwords for a small business or team, the enterprise-grade solutions reviewed on SecureKeyGenerator include policy enforcement and breach detection features.

Step 3: Enable Multi-Factor Authentication Everywhere

Microsoft research shows MFA blocks 99.9% of automated account attacks. Enable it on your email, banking, social media, and — critically — any account that uses the same email address or phone number that was exposed in the Charter leak. Our personal password security audit guide walks through MFA setup for every major service. For enterprise users who manage credentials across teams, the Kaspersky Premium security suite includes password management, breach monitoring, and cross-platform protection in one package.

Step 4: Set Up a SIM Swap PIN With Your Mobile Carrier

Contact your mobile provider (Verizon, T-Mobile, AT&T, or your carrier) and ask for a "port-out PIN" or "SIM swap passcode." This prevents attackers from porting your phone number to a SIM they control. Since ShinyHunters now has both your phone number and email, SIM swapping is a realistic threat. For extra privacy when managing accounts from public Wi-Fi or untrusted networks, Turbo VPN encrypts your connection and hides your online activity.

Step 5: Monitor Your Accounts for Suspicious Activity

Over the next three to six months, watch for:

• Password reset emails you did not initiate
• Unfamiliar login locations on your email, banking, and social accounts
• Phone calls from "Charter Support" asking you to verify account details
• SMS messages with shortened links claiming to be from Spectrum
• Credit card or bank transactions you do not recognise

Consider a credit freeze with Experian, Equifax, and TransUnion if your personal data exposure concerns you. For encrypted communications that keep your account recovery emails safe from prying eyes, TrekMail encrypted email provides end-to-end encryption for sensitive communications.

Charter Is No Stranger to Security Incidents

This is not Charter Communications' first brush with a high-profile intrusion. The telecom provider was among the organisations caught up in China's Salt Typhoon espionage campaign in 2025, a massive operation that targeted multiple US telecommunications companies. That campaign involved attackers gaining access to systems belonging to the "Committee on Foreign Investment in the United States" (CFIUS) and other government bodies.

The fact that Charter has now been compromised by both a state-sponsored Chinese espionage group and a criminal extortion gang highlights the scale of the security challenge facing major US telecommunications providers. These companies hold the keys to some of the most sensitive personal data in the country — call records, internet usage patterns, billing information, and location data — yet they continue to be breached by both nation-states and cybercriminals.

What This Means for the Password Security Landscape in 2026

The Charter breach, coming on the heels of Canvas and Carnival, signals a troubling acceleration in the pace and scale of customer data theft. ShinyHunters alone has now breached at least three major US corporations in a single month, exposing data on more than 280 million individuals when combining Canvas (275 million), Carnival (6 million), and Charter (4.9 million).

The common thread across all three breaches is social engineering — not sophisticated hacking. In each case, the attackers gained initial access by tricking employees into handing over credentials. This pattern aligns with the Verizon 2026 DBIR finding that the human element is involved in 62% of all breaches.

For consumers, the message is clear: a strong password on its own is no longer sufficient. The layered security model — unique passwords + password manager + MFA + breach monitoring — is now the minimum viable protection. Our earlier coverage of the Canvas breach phishing aftermath explains why the data in these leaks stays dangerous long after the initial disclosure.

FAQs

How many Charter customers are affected by the ShinyHunters breach?

Have I Been Pwned confirms 4.9 million unique customers are affected. ShinyHunters claimed 42 million records, which likely includes multiple records per customer (billing addresses, service addresses, contact emails) that were deduplicated to 4.9 million individuals.

What data was stolen from Charter Communications?

The confirmed stolen data includes names, email addresses, phone numbers, and physical addresses. A subset of about 85,000 records from an internal staff directory also contained job titles. Charter says no passwords, financial data, or customer proprietary network information (CPNI) was taken.

Did Charter pay the ShinyHunters ransom?

No. ShinyHunters confirmed on its leak site that Charter "failed to reach an agreement" and subsequently dumped the stolen data publicly. This contrasts with Canvas/Instructure, which reportedly paid between $5 million and $30 million to prevent their data from being leaked.

Should I change my Charter/Spectrum account password?

Yes. Even though Charter says no passwords were stolen, changing your password is a basic precaution. Use a strong, unique password — at least 16 characters — that you do not reuse on any other account. Our free password generator can create one instantly.

Will I receive phishing emails because of this breach?

It is highly likely. Attackers now have your name, email, phone number, and address — enough to craft convincing phishing emails that appear to come from Charter or Spectrum. Treat any unsolicited message asking you to log in, verify account details, or download software as suspicious. Navigate directly to spectrum.net rather than clicking links in emails.

Is this breach related to the recent Canvas and Carnival ShinyHunters attacks?

Yes. All three breaches occurred within weeks of each other as part of an ongoing ShinyHunters campaign targeting major US corporations. The group gains access primarily through social engineering and voice phishing, then extorts victims for payment before leaking stolen data.