The ShinyHunters extortion group conducted a successful attack on Charter Communications in April 2026 by compromising an employee's Microsoft Entra account through a voice phishing (vishing) attack. Using this access, they extracted approximately 42 million records from Charter's Salesforce environment, including personal and business customer data such as names, emails, phone numbers, physical addresses, job titles, plan information, support tickets, and some CPNI data. Despite Charter's statement denying exfiltration of sensitive personal or CPNI data, analysis by Have I Been Pwned confirmed that 4.9 million unique accounts were affected, with data subsequently leaked on the dark web after ransom demands were refused. The breach highlights ongoing risks to Salesforce customers from targeted attacks by ShinyHunters. Charter has involved law enforcement and has not disclosed further technical details or remediation steps publicly.

The breach exposed personal information of approximately 4.9 million Charter Communications accounts, including names, email addresses, phone numbers, physical addresses, and job titles for a subset of records. The exposure of this data can lead to increased risks of identity theft, phishing, and targeted social engineering attacks against affected individuals. Although Charter denies that sensitive personal information or CPNI was exfiltrated, the presence of some CPNI data in the stolen records as claimed by the attackers and independent analysis raises concerns about potential regulatory and privacy implications. The leak on the dark web increases the likelihood of misuse of the data by other malicious actors. No confirmed exploitation in the wild has been reported at this time.

Charter Communications has confirmed the breach and involved law enforcement authorities. The company has not disclosed specific remediation measures publicly. Since this incident involved compromise of an employee's Microsoft Entra account via voice phishing, organizations should reinforce phishing awareness training and implement strong multi-factor authentication controls for privileged accounts. Affected customers should be notified and advised to monitor for suspicious communications. The FBI advises victims not to pay ransom demands, as payment does not guarantee data protection. Patch status is not applicable as this was a social engineering attack rather than a software vulnerability. Check official Charter Communications advisories for updates and guidance.