-
The ransomware group ShinyHunters has reportedly published 80,190 records belonging to Ingram Content Group, following an alleged failed attempt of extortion.
-
The group reveals that compromised data includes names, email addresses, phone numbers and physical addresses.
-
In light of the incident, people connected to Ingram should remain vigilant on possible phishing messages and verify unusual requests through trusted channels.
The cybercrime group ShinyHunters claims it has released 80,190 records linked to Ingram Content Group, a major US book distributor. The group says it published the data after its attempt to force the company to pay money failed.
The claimed leak includes names, email addresses, telephone numbers, and addresses. For now, Ingram Content Group has not confirmed the incident publicly, leaving claims unverified.
ShinyHunters Publishes Data After Failed Extortion Attempt
ShinyHunters says it stole the information from Ingram Content Group during a security breach in April 2026. The group claims it collected about 1.70 GB of data during the incident.
According to the report shared by Daily Dark Web, the group later released a dataset containing 80,190 records. It says the public release focuses on user information rather than the full collection of files it claims to have taken.
The attack reportedly followed a common cybercrime method called pay-or-leak extortion. In this type of attack, criminals steal data and demand money from the affected organization. They threaten to publish the stolen information if the organization refuses to pay.
ShinyHunters has played out similar moves in other incidents of hacking. This group tends to target various organizations, claiming to steal sensitive data, and uses threats of public exposure as a tool of coercion for payments.
In a separate incident, Figure Technology confirmed a data breach after ShinyHunters published records it claimed to have stolen from the company.
The report does not confirm that every claim from the hacker group is true. Cybercriminals may exaggerate the amount of the stolen data or mischaracterize the information that they have stolen. Thus, investigators and impacted parties must check the information before stating the full extent of the loss.
Ingram Content Group has not publicly confirmed the case in the report. The company has also not verified the claimed number of records or the reported April timeline. Currently, reviewers should treat these details as claims from hackers themselves.
What Information Does the Alleged Leak Contain?
The group claims the published dataset contains four main types of personal information. These consist of names, emails, addresses, and phone numbers.
Although this type of information seems ordinary, criminals can utilize it to execute targeted crimes. For instance, knowing the name of a person and their place of work can allow an attacker to compose a message that appears relevant.
An email could help a criminal identify accounts associated with a victim. A phone number provides them with an additional contact method – enabling them to reach a victim through a phone call or via text messages. Additionally, access to a person’s home or business address allows criminals to make their messages appear credible.
However, the listed information in the report does not confirm other personal details, such as whether passwords, banking details, or other sensitive records appeared in the public dataset. This means that people should not assume that criminals obtained those details without further evidence.
The report also says the released dataset leaves out SharePoint folders containing photos, videos and PDF files. SharePoint refers to a web application that helps businesses in the procedure of storing, classifying and sharing documents. The decision to leave these folders out seems to imply that the public report concentrates on user data only.
However, the report fails to clarify what information these folders contained as well as if any confidential business data belonged to them. Their absence, however, can’t prove if hackers have accessed this information. The company would need to confirm the scope of any incident.
Why the Alleged Leak Could Lead to Phishing Attacks
Experts in security note that individuals related to Ingram Content Group may get targeted with phishing attempts. The allegedly leaked details may aid criminals to tailor their messages. An attacker can use the name & email address of a person to fake an account notification. Also, they may claim that the victim needs to verify publishing details or check a document.
These messages can appear to be authentic since they contain real names or business relationships. However, a known name does not guarantee that the message originates from a credible sender.
The Federal Bureau of Investigation in the US warns that ShinyHunters exploits organizations via data-stealing and extortion methods. Its guidance provides a short explanation of how criminals can use stolen or allegedly stolen personal information against victims.
Consequently, the workers at Ingram Content Group have to be vigilant when they see unexpected communications relating to their accounts. They should refrain from opening questionable attachments and clicking unknown links. They should also verify unusual requests through a known contact method.
The Cybersecurity and Infrastructure Security Agency strongly recommends that people closely examine potentially suspicious communications and inform the proper authorities in case of detection of phishing attacks.
What Ingram Contacts Should Do Now
Anyone affiliated with Ingram Content Group must remain vigilant for the time being, as the situation is still unconfirmed. Authors, buyers, booksellers and other partners must pay attention to any unusual communications in reference to their names or details related to their work and accounts.
They must also refrain from responding to unsolicited inquiries that ask for passwords, authentication codes, or bank details. If you receive a message allegedly from Ingram Content Group, it is advisable to verify it through the company’s official website or another trusted channel.
Additionally, individuals should make use of unique passwords for their accounts and utilize multi-factor authentication for additional security if possible.
It is also helpful to monitor accounts for any sign of unusual behavior. In case an email causes even slight suspicion, users have to report it through the available reporting options of the email provider. They should avoid using contact details available in a message they suspect is fake.
For now, the most important point is that Ingram Content Group has not publicly confirmed the alleged breach.
