Back Scworld

Amtrak allegedly breached by ShinyHunters, massive data leak threatened

Scworld • April 16, 2026

Hacking group ShinyHunters has listed the National Railroad Passenger Corporation on its data leak site, claiming to have stolen 9.4 million records containing personally identifiable information and corporate data, Cybernews reports.

The hackers reportedly obtained unauthorized access via Salesforce. The gang has previously targeted Salesforce employees via social engineering attacks. The attack allowed ShinyHunters to obtain the access details of different companies using the Salesforce platform. While samples of the stolen data have not been released, ShinyHunters threatened to expose the pilfered information on Apr. 14 if the ransom is not paid.

"When PII is involved, there's always a chance of social engineering attacks. The impact depends whether the data in question belongs to the company employees or customers. In Amtrak's case it could be either, since Amtrak sells train tickets," according to Cybernews researchers. ShinyHunters has claimed the attacks on Mercer Advisors, Beacon Pointe Advisors, Cisco Systems, Hallmark, and Rockstar Games.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShinyHunters Target SSO Accounts in Voice Phishing Attacks The ShinyHunters extortion gang has claimed responsibility for a series of voice phishing attacks targeting single sign-on (SSO) accounts at major platforms including Okta, Microsoft, and Google. In these attacks, threat actors impersonate IT support to trick employees into providing their credentials and multi-factor authentication codes, enabling access to corporate SaaS platforms and potential data theft for extortion purposes. 191 sources 51

Extracted Entities

Amtrak allegedly breached by ShinyHunters, massive data leak threatened

The full story

Extracted Entities

Attack Types (1)

Companies (8)

MITRE ATT&CK (1)