CyrusOne cyrusone.com CyrusOne data breach: what happened and what to do
In August 2026, data centre operator CyrusOne was targeted in a ShinyHunters pay-or-leak extortion attempt. About 373,000 email addresses leaked, mostly corporate contact details and support tickets.
View all 13,177 breaches- Breach date
- 5 Aug 2026
- Affected
- 373,460
- Data exposed
- Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. According to Have I Been Pwned, the group then published data allegedly obtained from the company. It held 373,460 unique email addresses across records for users, sales leads and CyrusOne employees. Cybernews covered the extortion claim.
Sources checked: haveibeenpwned.com, cybernews.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The data is mostly corporate contact information: names, email addresses, phone numbers, physical addresses, employers and job titles. It also includes support tickets and other information about the company's operations.
What that means for you
Work contact details with a job title and employer are what business email scams run on. Support tickets can show real projects and vendors, which helps an attacker pose as a supplier or colleague and ask for payment or access.
The records cover three groups of people: CyrusOne users, sales leads and employees. Most of the contact details are business ones, not home addresses.
What to do
If you work with CyrusOne, check unexpected requests for invoices, access or credentials with a known contact, and tell your IT team.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Job titles and employers make fake invoice or access requests look legitimate. Don't click links or call numbers in unexpected messages. Go to the company's site yourself, and report scam messages at reportfraud.ftc.gov.
- 2
Verify payment and access requests
If a message asks you to change bank details, send a payment or share access, confirm it with a contact you already know by phone.
- 3
Tell your IT or security team
If you use a work email that appeared, let your employer know so they can watch for targeted phishing.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone number. Serus also alerts you when your details show up in a new one.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the CyrusOne breach?
If you were a CyrusOne user, sales lead or employee, possibly. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, physical addresses, employers, job titles and support tickets.
Who is behind it?
Have I Been Pwned says ShinyHunters ran a pay-or-leak extortion attempt and then published the data.
Should I change my password?
No passwords are listed in this breach. Reused passwords are worth changing anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
