Kodak confirms data breach as ShinyHunters claims theft of 2.2 million records

Breach highlights danger of data extortion attacks

Kodak has confirmed that hackers have accessed a “limited set” of data and that it has engaged external cybersecurity experts to investigate.

The global photography, print and imaging firm confirmed the breach in a statement to Bleeping Computer, which said:

“Kodak recently discovered that an unauthorized third party temporarily accessed a limited set of company data. We quickly involved external cybersecurity experts to investigate what data was accessed and copied,” Kodak stated. “We are working with law enforcement and believe there is no threat to our systems or operations. We will provide further updates as needed.”

A company spokesperson did not respond to a follow-up email asking whether the breach extended to Kodak’s internal network, and Kodak has not yet disclosed how the attackers gained access to its systems and data.

The ShinyHunters extortion group has claimed responsibility for the hack, claiming it has stolen over 2.2 million records containing customers’ personally identifiable information and internal corporate data. The group threatened to release the data today. An extract from the group’s dark web site reads:

“Over 2.2 million records with customer PII and other internal data were compromised,” they said. “This is a final warning to contact us by June 18, 2026, before we leak the data along with various digital problems that will affect you.”

Whilst Kodak has yet to confirm how the breach occurred, ShinyHunters has been linked to breaches at numerous third-party providers. It claims to have attacked hundreds of Salesforce customers by stealing more than 1.5 billion records from Salesforce Aura and Salesloft Drift campaigns.

Last week, ShinyHunters claimed responsibility for a new wave of attacks on over 100 organizations, including the University of Nottingham and the Council of Europe following data thefts that exploited a zero-day vulnerability in Oracle’s PeopleSoft enterprise software.

Commenting on this, Dray Agha, Senior Manager, Security Operations Center at Huntress, said:

"Although Kodak has stressed that only a 'limited amount' of data was impacted, the involvement of a known extortion group targeting a legacy organisation with a vast portfolio of 79,000 patents serves as a stark warning to the manufacturing sector. Attackers are increasingly pivoting from standard operational disruption to the lucrative theft of specialised intellectual property, making swift forensic action and transparent communication absolutely critical".

James Neilson, SVP of Global at OPSWAT chose to emphasise the pattern of lateral movement that ShinyHunters uses to track down data.

“ShinyHunters primarily targets companies through data extortion and service disruption to force organisations to pay. The one positive is that, according to Kodak’s statement, the group was stopped before it could disrupt operations and systems. Given Kodak’s role across several critical infrastructure sectors, any disruption could have had a significant impact.

Previous attacks show that ShinyHunters relies heavily on lateral movement to spread across systems. The group is not slowing down anytime soon, making it crucial for organisations to stop them before they hit critical systems. By inspecting files in transit across devices, users and the wider digital supply chain, organisations can reduce the likelihood and impact of cyberattacks and data breaches.”