2.7 Million Sysco Emails Leaked Following ShinyHunters Data Breach
- Campaign Confirmed: ShinyHunters targeted Sysco in a June 2026 "pay or leak" extortion campaign.
- Data Exposed: The published dataset contained approximately 2.7 million unique email addresses.
- Records Affected: Compromised information spanned both staff and customers.
Sysco, the food distribution company, was targeted by a ShinyHunters "pay or leak" extortion campaign in June 2026. After the demand, the threat group published a dataset it claims was taken from Sysco. Breach Notification Service Have I Been Pwned (HIBP) added 2,691,852 compromised accounts to its database on June 28.
2.7 Million Email Addresses Leaked
The exposed records consisted largely of corporate contact information, combining identifying details with business-related fields, exposing a large volume of corporate and personal information tied to staff and customers.
According to HIBP, the Sysco data breach includes:
- Customer feedback
- Email addresses
- Employers
- Job titles
- Names
- Phone numbers
- Physical addresses
- Usernames
ShinyHunters Target Streak
The ShinyHunters extortion model pressures targets to pay before stolen data is released. When the demand went unmet, the actors published the Sysco dataset, shifting the incident from a private extortion attempt to a public exposure.
The threat actor claimed to have stolen more than 61 million Salesforce records. The Qilin ransomware group also announced in early May that it had breached the USA-based grocery retail and food distribution company.
Other recent companies claimed by the extortion group include American Tower and Ralph Lauren. In March, ShinyHunters said it compromised Snowflake, Okta, Sony, AMD, Lastpass, and Salesforce Data Compromise via a massive Salesforce breach.






