Kodak Investigates Data Breach After ShinyHunters Claims Theft of 2.2 Million Records

Kodak has reportedly confirmed it is looking into a data breach. The company says an unauthorized person briefly got into some of its systems.

The photography and printing company is now working with outside experts and law enforcement. This is to figure out exactly what information was taken.

Kodak Acknowledges Security Incident

Kodak, a digital print and camera company based in Rochester, New York, recently discovered a data breach. According to the company, someone from outside managed to break in and access a “limited amount” of its data for a short time.

Kodak’s response was quick. They brought in outside cybersecurity experts to figure out exactly what information might’ve been seen or copied. Kodak says they don’t think the breach threatens their systems or disrupts daily business.

This company’s been around since 1880 and still maintains a top spot in the commercial printing arena. They also deal on advanced digital printing materials, chemicals, and hold tens of thousands of patents all over the world.

ShinyHunters Makes Bold Claims

Although Kodak has admitted the incident, they never mentioned any names of possible attackers. Also, they didn’t say anything specific regarding how much data the attacks stole.

But hacker group ShinyHunters has stepped in to provide the missing information through their own claims via a post on their dark website. They claim to have stolen more than 2.2 million records from Kodak.

According to the group, the stolen information includes customer personal information and internal corporate data. The group set a deadline. It is warning Kodak to make contact by June 18, 2026. If that deadline passes without a deal, the attackers say they will publish the data online.

So far, Kodak has not confirmed any of these claims. As far as we know, no independent analyst has dissected the alleged 2.2 million records to actually see what’s inside. This has created a major disparity between company statements and what the hackers claim.

A Familiar Threat Actor

The Kodak incident is just the latest attack claimed by ShinyHunters. The group has become one of the most active names in data extortion over the past several years.

ShinyHunters don’t play by the same rules as most ransomware criminals, who often just block access to systems and demand ransom. They would rather steal the entire database containing sensitive information, withhold it, and then threaten the victim to pay up, or else, everything goes public. Their primary motivation is financial gain.

The group has been linked to a lot of high-profile data breaches. They’ve targeted companies, schools, and tech providers. Just this year, ShinyHunters has claimed responsibility for breaches at several major organizations.

The group has also claimed several attacks against Salesforce customers over the past year. They also were tied to breaches involving multiple Snowflake customers.

ShinyHunters’ tactics have had serious consequences. A global hack on Oracle software exposed the health data of NHS patients and other victims, demonstrating the real-world impact of these attacks.

Connection to Recent Oracle PeopleSoft Attacks

The Kodak claim surfaced only days after ShinyHunters took credit for another large operation. This one involved Oracle PeopleSoft software.

Based on reports, they allegedly compromised more than 100 organizations by exploiting a software flaw. These attacks reportedly affected organizations across several sectors, including higher education. The University of Nottingham is one of the publicly identified victims.

Security researchers have described the PeopleSoft campaign as one of the most significant enterprise software attacks disclosed this year. It shows how cybercriminal groups continue to focus on widely used business systems.

For now, many important details remain unknown. Kodak has not disclosed what types of information the hackers accessed. It is not clear if it impacted customer records or employee data.

Another question is how the attackers got in. It is unknown if they breached Kodak’s internal network. The breach may have also happened via a third-party system.

Now, customers, suppliers, and others are waiting for the results of the investigations by law enforcement and other authorities. Generally speaking, organizations will hold off on providing specific details until the forensic investigation has been able to determine what has transpired.

What’s Next?

Kodak’s still looking into the attack, trying to get to the bottom of everything. They’ve teamed up with some outside professionals and law enforcement to investigate. The big question: what exactly did the attackers steal?

All eyes are now on whether ShinyHunters follows through. The clock is ticking. ShinyHunters’June 18 deadline is right around the corner. If the group actually publishes the data, that’ll confirm the extent of damage.

The coming days will show if this is a limited breach, as Kodak suggests. Or it could be a much larger exposure, matching the claims made by the attackers.