ShinyHunters Hackers Claim Theft of 3M+ Cisco Records, Threaten Public Leak

ShinyHunters has posted a final warning to Cisco asserting it exfiltrated more than three million Salesforce records plus GitHub repos, AWS buckets, and internal documents, and threatens to publish the data and cause unspecified “digital problems” if Cisco does not make contact by April 3, 2026. The group provided redacted screenshots suggesting organization-level AWS access, referenced UNC6040 (GTIG’s designation), and linked the claims to prior Salesforce-related breaches and vishing-based access methods; independent verification by Cisco is pending.