Kodak confirms data breach claimed by ShinyHunters extortion gang

Kodak has confirmed that it is working with external cybersecurity experts to investigate a security breach after hackers gained access to some of the company's data. The incident came to light after the ShinyHunters extortion gang claimed responsibility on their dark web leak site, threatening to leak the stolen data if a ransom is not paid.

Founded in 1880 as the Eastman Kodak Company and headquartered in Rochester, New York, Kodak holds 79,000 worldwide patents and provides commercial print, advanced materials, and chemical products. A company spokesperson told BleepingComputer that attackers only accessed a "limited amount" of data in the incident, but did not reply to a subsequent email asking if they breached Kodak's internal network.

"Kodak recently discovered that an unauthorized third party illegally gained temporary access to a limited amount of company data. We promptly engaged external cybersecurity experts to support an investigation of what data was accessed and copied," Kodak said. "We are working with law enforcement and are confident there is no threat to our systems or operations. We will share additional updates as appropriate."

While the company has yet to attribute this breach, the ShinyHunters extortion group has claimed responsibility on their dark web leak site. The cybercrime gang said that they allegedly stole over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data and threatened to leak the exfiltrated data on Thursday. "Over 2.2 million records containing customer PII and other internal corporate data was compromised," they said. "This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way."

Although Kodak has yet to disclose how the threat actors gained access to its systems, ShinyHunters has also claimed attacks against hundreds of Salesforce customers over the past year, saying they've stolen over 1.5 billion records in Salesforce Aura and Salesloft Drift campaigns. ShinyHunters was also linked to security breaches at over a dozen Snowflake customers and various other third-party integration providers.

One week ago, the extortion group also claimed responsibility for a new series of breaches at over 100 organizations (including the University of Nottingham) following data-theft attacks that exploited a zero-day flaw in Oracle's PeopleSoft enterprise business software suite. The Kodak breach adds to a growing list of high-profile victims targeted by ShinyHunters, which has become one of the most prolific extortion groups in recent years.

The breach exposes Kodak to potential data leaks and operational disruption, as well as reputational damage. With the deadline set for June 18, 2026, the company faces pressure to respond to the extortion demands or risk having sensitive customer and corporate data published online. The incident underscores the persistent threat posed by extortion gangs that target both large enterprises and public institutions.

In a statement provided to the media, Kodak confirmed that an unauthorized third party briefly accessed a limited amount of company data and has engaged external cybersecurity experts and law enforcement. The company added that there is no threat to its systems or operations, though it has not independently verified ShinyHunters' claim of over 2.2 million records. The ShinyHunters group has set a June 18 deadline for Kodak to respond or face a public leak of the exfiltrated data.

Kodak confirmed to SecurityWeek that the breach involved unauthorized access to a limited amount of company data, but stated the incident has been contained and there is no ongoing threat to its systems or operations. The company is conducting an investigation with external cybersecurity experts and has notified law enforcement. ShinyHunters had threatened to leak the stolen data on June 18 unless a ransom was paid, though Kodak did not disclose whether it intends to pay.

The Malwarebytes report adds that ShinyHunters has not yet publicly provided proof of the stolen data, a common extortion tactic, and notes that the group is known for using social engineering, bribery, and zero-day supply-chain attacks. Kodak has engaged external cybersecurity experts and notified law enforcement, stating the breach was limited in scope and contained. The article also advises affected users to change passwords, enable MFA, and consider credit freezes.

The UK Cyber Monitoring Centre (CMC) has released an analysis of the Canvas data breach, revealing that roughly 160 UK universities and 9,000 educational institutions globally were affected, with stolen data including confidential course and user information. The CMC's review found the losses were driven more by incident response and recovery costs than business interruption, and it offered recommendations such as enforcing MFA consistently and testing incident response plans for breach scenarios. The report also highlighted ongoing phishing risks from the exfiltrated data, reinforcing the need for clear communication and third-party access controls in higher education.