Follett Software LLC Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Follett Software LLC was listed by the shinyhunters ransomware group on April 30, 2026, with internal files reported as exfiltrated in the attack. An undisclosed number of individuals may have been affected; anyone connected to the company should verify their status and review recommended protective steps.
Breaking down the breach
The incident was first reported on 30 April 2026 when shinyhunters listed Follett Software LLC on its leak site. The group stated that internal files had been exfiltrated during a ransomware attack and set a deadline of 4 May 2026 for contact. An update appeared on 1 May 2026 describing the listing as a final warning. No independent confirmation of the claimed volume or contents has been made public, and the exact timing or method of the intrusion is not disclosed in available records.
Who is shinyhunters?
Shinyhunters is a ransomware operator that has appeared repeatedly on data-leak forums since at least 2020. The group typically claims to have stolen files from targeted organisations, lists those organisations on a public site, and threatens to release the material unless payment is received. Its listings are presented as claims by the group itself; independent verification of the data or the circumstances of each incident varies.
About Follett Software LLC
Follett Software LLC develops and supplies administrative and library-management systems used by schools, colleges and libraries. These platforms commonly process records that include student, staff and patron information. A compromise at a company in this sector can therefore affect large numbers of individuals whose data is held for educational or institutional purposes.
What data was at risk
The only detail provided in the listing is that internal files were taken. The group claims the material includes more than four million Salesforce records containing personally identifiable information and other corporate data. The precise categories of information involved have not been confirmed by Follett Software LLC or by any independent investigation.
The real-world impact
Exposure of internal files can create opportunities for follow-on fraud or targeted social-engineering attempts against the people whose details appear in those files. For the organisation, the incident adds operational costs related to investigation, notification and remediation. Because the scale and contents remain unconfirmed, the full extent of any downstream effects cannot yet be measured.
If your data was in this claimed breach
Individuals who believe their information may have been held by Follett Software LLC can take several practical steps to limit potential misuse.
- Review account statements and credit reports for unusual activity.
- Enable multi-factor authentication on any accounts that still use passwords alone.
- Consider placing a fraud alert or credit freeze with major bureaus if financial details could be involved.
- Run a free exposure scan of your email address against known breach data to check for additional appearances.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
moody.edu Listed by shinyhunters Ransomware Groupicc.edu Listed by shinyhunters Ransomware Grouphccs.edu Listed by shinyhunters Ransomware GroupHoughton Mifflin Harcourt Company Listed by shinyhunters Ransomware GroupLatest breaches
Publicly posted by shinyhunters — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.