ctipilot.ch

Kodak breach

incident · incident:kodak-shinyhunters-breach

Kodak confirms a breach after a ShinyHunters leak-site listing; the June 18 publication deadline passed without a leak.

Coverage timeline
1
first 2026-06-20 → last 2026-06-20
Peak priority
notable
1 notable
Sources cited
3
3 hosts
Sections touched
1
active-threats
Co-occurring entities
1
see Related entities below
ATT&CK techniques
0
no mapped behavior yet

Hunting pivots

Tags
data-breachorganized-crime

Story timeline

  1. 2026-06-20Kodak confirms breach after ShinyHunters leak-site listing; June 18 deadline passed without publication
    active-threats

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

attributed to

Where this entity is cited

  • active-threats1

Source distribution

  • bleepingcomputer.com1 (33%)
  • malwarebytes.com1 (33%)
  • securityweek.com1 (33%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (3)

Entries about Kodak breach (1)

2026-06-20 · view entry permalink →

NOTABLE

Kodak confirms breach after ShinyHunters leak-site listing; June 18 deadline passed without publication

Eastman Kodak acknowledged on 17 June 2026 that "an unauthorized third party illegally gained access to a limited amount of company data," after ShinyHunters listed it on their dark-web leak site on 15 June claiming 2.2 million PII records and set an 18 June contact deadline (SecurityWeek, 2026-06-18; BleepingComputer, 2026-06-17). As of the deadline ShinyHunters had not published samples — consistent with the group's pattern of withholding proof to maximise leverage. Kodak did not disclose the access vector; ShinyHunters' 2026 campaign has leaned on misconfigured Salesforce Experience/Aura guest-user access, Oracle PeopleSoft (CVE-2026-35273) and Snowflake credential stuffing across 100+ victims, with the group claiming a 1.5-billion-record Salesforce corpus (BleepingComputer, 2026-06-17).

incident20 Jun 05:12Zmulti-sourceOpen finding ↗
Sources: SecurityWeek · BleepingComputer · Malwarebytes