The cybercriminal group ShinyHunters has published data stolen from American Tower Corporation, one of the largest cell tower operators in the United States, in a breach that exposed not only customer and employee records but also plaintext physical access codes to tower compounds across the country.
What was taken
American Tower Corporation, a major US telecommunications infrastructure provider, was the target of a ShinyHunters “pay or leak” extortion campaign that led to the theft and publication of personal data on hundreds of thousands of individuals.
On June 12, 2026, ShinyHunters claimed responsibility for a cyberattack against American Tower Corporation, a leading telecommunications infrastructure provider in the US. The incident involved data allegedly taken from customers, employees, contractors, and business leads.
ShinyHunters alleged to have compromised over 5.2 million records. The announcement said the dataset contained more than 5.2 million records, including customer and landowner PII, tower asset records, GPS coordinates, physical access codes, and internal corporate documents. The group claimed the exfiltrated documents also concerned records tied to other companies such as T-Mobile, Verizon, and DHS.
ShinyHunters published about 574,000 unique email addresses with names, phone numbers, physical addresses, and geographic data. Reporting also described tower asset records with GPS data and plaintext physical access codes among the wider stolen set. The American Tower data breach exposed 216,601 accounts that were added to breach notification service Have I Been Pwned (HIBP) on June 26, 2026. The HIBP-verified dataset, covering more than 200,000 unique email addresses belonging to employees, contractors, customers, and leads, also included names, addresses, and phone numbers.
The inclusion of plaintext gate codes is what sets this incident apart from a standard data theft. Unlike stolen passwords, which can be reset remotely, physical access codes govern locks and barriers at tower sites. A threat actor with that data could reach equipment that sits at the backbone of US mobile networks.
ShinyHunters’ extortion timeline
ShinyHunters updated its dark web leak site with a wave of alleged victims, threatening to publish data belonging to American Tower Corporation and several other organizations if negotiations failed.
Data has been published on the group’s leak site, with the attack date recorded as June 12, 2026. ShinyHunters warned it would leak the data and cause additional disruption if American Tower did not make contact before its stated deadline.
The postings form part of a broader extortion campaign that has seen ShinyHunters repeatedly target large enterprises, educational institutions, and government entities throughout 2026.
The group was also identified as the actor behind the largest educational security breach on record, the late April 2026 Canvas LMS incident. In late April 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. The hack is considered the largest educational security breach on record, affecting 8,809 universities, educational ministries, and other institutions worldwide. ShinyHunters claimed to have stolen 3.65 terabytes of data from approximately 275 million users , though Instructure has not confirmed the attackers’ claims of 275 million affected users and 3.6 TB of stolen data.
Breach monitoring services that first reported the leak site postings noted that the claims remained unverified and that the authenticity of the datasets had not been independently confirmed. American Tower Corporation had not issued a public statement confirming or denying the breach at the time of publication.
Why infrastructure data is different
Cell towers are classified as critical communications infrastructure. The GPS coordinates in the leaked dataset map the precise physical location of tower compounds, while the gate codes would theoretically allow a bad actor to bypass perimeter security at those sites.
Security researchers note that this combination creates risk beyond what a conventional credential leak entails, since no software patch can rotate a physical padlock code without a technician visiting each site.
The scale and variety of data in the American Tower claim reflects a pattern in which attackers target infrastructure operators specifically because their records bundle physical and digital access information in a single repository.
The breach also underscores a documented shift in attacker strategy. Many major incidents in 2026 began with a person rather than a software flaw, whether a help desk agent who handed over a credential, an employee who surrendered a single sign-on token through phishing, or a vendor whose account was compromised. American Tower’s attack vector has not been publicly confirmed.
Broader 2026 context
ShinyHunters has demonstrated sustained capacity to operate at scale in 2026. The group claimed the Aura identity-protection breach, disclosed in March 2026, in which an unauthorized third party gained access to an employee account via a targeted voice phishing attack and accessed approximately 900,000 records. It also claimed the Canvas LMS incident in late April and a separate assault on the National Association of Insurance Commissioners in June.
In the NAIC incident, ShinyHunters claimed to have compromised more than 3.1 terabytes of data. The NAIC said the group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. NAIC said no personally identifiable information or payment information was accessed.
Organizations managing physical infrastructure with digitally stored access credentials are increasingly urged to treat those records with the same urgency as financial data, using tighter cloud access controls and routine rotation of site-level security codes independent of any breach notification.
