American Tower Data Breach: 215,000+ Accounts Exposed in ShinyHunters Attack
Published
Key Takeaways
- Breach Confirmed: ShinyHunters targeted American Tower in a June 2026 "pay or leak" extortion campaign.
- Data Exposed: The leaked dataset contained more than 215,000 unique email addresses and attached details.
- Records Affected: Compromised information spans employees, contractors, customers, and leads.
The recent American Tower data breach exposed 216,601 accounts, which were added to breach notification service Have I Been Pwned (HIBP) on June 26, 2026. The company became the target of a ShinyHunters extortion campaign in June 2026, which ultimately led the threat group to publish data concerning employees, contractors, customers, and leads.
Scope of the Compromised Data
The American Tower data breach leaked a combination of identifying details and contact information, according to HIBP. The full set of compromised data fields belonging to the telecom tower infrastructure company includes:
- Email addresses
- Job titles
- Names
- Phone numbers
- Physical addresses
The announcement said the dataset contained more than 5.2 million records, including customer and landowner PII, tower asset records, GPS coordinates, physical access codes, and internal corporate documents. The hacker group claimed the exfiltrated documents also concerned records tied to other companies such as T-Mobile, Verizon, and DHS.
ShinyHunters’ Breach Activity
The campaign followed ShinyHunters' established extortion model, with the threat actor ultimately publishing stolen data allegedly taken from American Tower.
Other intrusions connected to ShinyHunters this month include Kodak, Ralph Lauren, Amazon’s One Medical Senior Health, Council of Europe, and Infinite Campus.
In April, LAPSUS$ claimed to have breached Vodafone U.K., and in February, a data breach at the telecom provider Odido, which was also linked to ShinyHunters, exposed millions of Dutch customer records.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular