ZenBusiness zenbusiness.com ZenBusiness data breach: what happened and what to do
In March 2026, the ShinyHunters extortion group claimed to have taken ZenBusiness data and later published it. Have I Been Pwned added about 5.1 million accounts: email addresses, often with names and phone numbers.
View all 13,115 breaches- Breach date
- 27 Mar 2026
- Affected
- 5,118,184
- Data exposed
- Email addresses, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ZenBusiness is a company that helps people form and run small businesses: registering an LLC, filing annual reports, getting an EIN. In March 2026, the hacking and extortion group ShinyHunters claimed it had obtained a large amount of ZenBusiness data and threatened to publish it unless a ransom was paid, according to Have I Been Pwned (HIBP).
The group said the data came from platforms including Snowflake, Mixpanel and Salesforce. TechRadar reported that the group described it as several terabytes and set a deadline. HIBP says that the following month, after claiming payment hadn't been made, ShinyHunters publicly released it.
HIBP dates the incident to 27 March 2026 and added it on 2 May 2026. It counted 5,118,184 accounts, with about 5 million unique email addresses. The data spans many systems and business functions, including leads, support records and other CRM-related data.
What was exposed
HIBP lists:
- Email addresses
- Names
- Phone numbers
Which fields appear for a given person depends on which source file they were in. Many people have only an email address in the data. Others have a name and phone number too.
Because the data came from CRM and lead files, people who never became customers can be in it. A person who requested a quote, signed up for a webinar, or opened a trial account could appear.
The HIBP entry doesn't list passwords, Social Security numbers or payment details. A company like ZenBusiness holds sensitive business-filing data, and the entry doesn't say any of it was published, so don't assume it was or wasn't. Check the company's own notices.
What this lets criminals do
A name, a phone number and an email, linked to a business-formation service, make good bait. A scammer can pose as ZenBusiness or as a state agency and say your annual report is overdue, your registered agent has changed or your business filing needs a fee. Small-business owners get these messages already, and they land more easily when the sender knows you started a business.
Expect:
- Emails or texts about an "overdue" annual report or compliance fee
- Calls offering to fix your business listing or registered agent
- Fake invoices that mention ZenBusiness
If you're a business owner, also watch for requests to change payment details on a real invoice, since attackers use contact data to impersonate vendors.
The company's response
The coverage cited here doesn't include a notice from ZenBusiness, and HIBP's entry describes the incident as claimed by the extortion group. If ZenBusiness contacts you, open its site directly instead of following links in a message.
What you can still do
If you ever gave ZenBusiness your details, assume your email and phone are in the file. Be sceptical of any message that mentions your business filings and asks for a payment, and check state fees and deadlines through the state's own website.
What to do if you were in it
- 1
Treat filing and fee messages as suspect
Emails or texts about an overdue annual report, a compliance fee or a registered agent change are a common scam. Check deadlines on your state's official site.
- 2
Verify invoices and payment changes
If a vendor asks you to change bank details, call them on a number you already have. Never pay a new invoice from a message alone.
- 3
Change your ZenBusiness password and turn on two-factor login
HIBP doesn't list passwords here, but a fresh password is cheap. Replace it anywhere you used the same one.
- 4
Be careful with calls that know your business
A caller who knows your company name and phone number isn't proof of who they are. Hang up and call back on a number you looked up.
- 5
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 6
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the ZenBusiness data breach?
Look up your email on Have I Been Pwned. If ZenBusiness is listed, your email and any name or phone number in the files were exposed.
What was exposed?
About 5 million email addresses, often with names and phone numbers, depending on the source file, according to Have I Been Pwned.
Who claimed the attack?
The extortion group ShinyHunters claimed the data and later published it after saying payment hadn't been made.
Should I change my password?
HIBP doesn't list passwords in this breach. Changing yours and turning on two-factor login is a sensible precaution.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
