ZenBusiness data breach
5,118,184 accounts exposed in a breach on 27 March 2026.
At a glance
5,118,184
Accounts exposed
27 March 2026
Date of the breach
2 May 2026
Added to the list
What happened
In March 2026, the hacker and extortion group "ShinyHunters" claimed to have obtained a substantial corpus of data from ZenBusiness, a business formation and compliance platform. The group claimed the data had been exfiltrated from platforms including Snowflake, Mixpanel and Salesforce, and threatened to publish it if a ransom was not paid. The following month, after claiming payment had not been
What was exposed
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Names. Names were exposed. Scammers use real names to make a message look personal.
- Phone numbers. Phone numbers were exposed. Expect scam calls and text messages, some of them pretending to be the organisation.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Gîtes de France
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches.
- Booking details
- Email addresses
- Names
- Phone numbers
- +1 more
Read what happened
Crunchbase
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt.
- Email addresses
- Employers
- Job titles
- Names
- +3 more
Read what happened
Sharecare
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign.
- Dates of birth
- Email addresses
- Employers
- Genders
- +6 more
Read what happened