Kodak Confirms Data Breach Claimed by ShinyHunters: Ransomware Claim — What’s Alleged & What To Do

Kodak has confirmed that an unauthorized third party gained temporary access to a limited amount of company data. The incident was reported on June 17, 2026, and involves claims affecting 2.2 million records that include customer personally identifiable information and internal corporate data. The company has stated that it engaged external cybersecurity experts and law enforcement following the discovery. A claim of responsibility was made by a group using the name ShinyHunters, which asserted that the records were stolen and threatened to release them.

Breaking down the breach

Kodak described the access as temporary and limited in scope. No further technical details on the entry method, duration of access, or specific systems involved have been released by the company. The 2.2 million figure originates from the third-party claim rather than an independent confirmation of records taken.

Public information on whether any data has been published or used remains unavailable at this stage. Kodak has not disclosed additional metrics such as exact file counts or categories beyond the broad descriptors of customer and corporate data.

How a breach like this happens

Incidents involving unauthorized access to corporate systems often begin with the exploitation of remote services, stolen credentials, or unpatched software. Once inside, an actor may locate and copy data repositories before detection occurs.

Organizations frequently respond by isolating affected systems, engaging incident-response teams, and notifying authorities. The precise sequence in any single case depends on factors that are not always made public.

Kodak and its sector

Kodak operates in the imaging and printing sector, where companies maintain records related to customers, suppliers, and internal operations. Such organizations routinely process contact details, account information, and business correspondence.

A claimed incident at a firm of this type can affect both individuals whose records are held and the company’s own operational data. The presence of customer information alongside corporate records increases the range of potential follow-on uses for any material that is exposed.

The information in question

The facts released so far name personally identifiable information, customer data, and corporate data as the categories referenced in the claim. Kodak has characterized the accessed material as limited, while the third-party assertion describes 2.2 million records containing customer PII and internal corporate data.

The exact contents of any files have not been independently verified or itemized by the company. Organizations in this sector commonly hold names, addresses, account identifiers, and business documents, but confirmation of which specific fields were present is not available.

What's at stake

Individuals whose information appears in such records may face risks of targeted phishing, account takeover attempts, or misuse of personal details in other contexts. Corporate data can reveal internal processes or contacts that adversaries might exploit for further access.

For the organization, the incident adds costs for investigation, potential regulatory notifications, and measures to prevent recurrence. The long-term impact depends on whether the claimed records are released and how the data is subsequently used.

If your data was in this claimed breach

Monitor financial and email accounts for unusual activity and enable multi-factor authentication where available. Consider requesting credit reports and placing fraud alerts if personal identifiers were involved.

Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data. Organizations advise changing passwords and watching for official notices from the affected company.

AICompiled with AI assistance from public sources and published under our editorial standards.