Disney/Hulu claims data leak by shinyhunters

• Ransomware group: shinyhunters
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: October 3, 2025

Shinyhunters claims to have leaked Disney/Hulu data

The threat group known as shinyhunters has published an announcement on their leak site claiming to have compromised data belonging to Disney/Hulu. According to the post, the group has exfiltrated a massive dataset that allegedly contains over 94 million records. This announcement, made on October 3, 2025, suggests a significant breach of the organization's data security. The group has issued a warning to the organization, suggesting that they should reach out to the attackers to prevent the data from being released publicly.

The group claims that the attack occurred on May 1, 2025. While the announcement confirms the intent to leak the data, no ransom demand has been specified in the public listing. In many modern cyberattacks, threat actors utilize a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to demand a ransom for decryption; they also steal sensitive data and threaten to leak it on public forums if the ransom is not paid. This adds significant pressure on the victimized company, as the threat of public exposure can lead to severe reputational and regulatory consequences.

Details of the alleged data exfiltration

The alleged breach involves a substantial amount of information, with the group claiming a total data size of 36 GB. The volume of records mentioned—over 94 million—indicates a potential large-scale exposure of user information. Based on the information provided by the threat actor, the dataset is not limited to basic identifiers but includes various technical details related to user accounts.

The specific types of information allegedly contained within the leaked dataset include:

• Full names
• Email addresses
• Phone numbers
• User account details

Furthermore, the group has provided screenshots that appear to display various user account details and technical field names related to subscription information. This type of information is highly sensitive as it can be used to map out user behaviors and account structures within a digital platform.

About The Walt Disney Company

The Walt Disney Company is a multinational media and entertainment conglomerate operating worldwide. The company provides services across a wide range of sectors, including film production, television broadcasting, digital streaming platforms, and theme parks. Given its massive global footprint and the variety of services it provides, the company maintains a vast database of user information to support its digital and physical operations.

Potential risks and security implications

This alleged breach may create significant risks for the affected users, particularly regarding phishing and fraud attempts. When personal identifiers such as names, emails, and phone numbers are exposed, attackers can craft highly convincing social engineering campaigns to deceive users into revealing further sensitive information or financial credentials. Such identity theft risks are a common consequence of large-scale data leaks.

For the organization, the exposure of over 94 million records could lead to negative impacts on customer trust. Maintaining consumer confidence is vital for digital streaming and media services. Additionally, because the entity is based in the United States, the incident may trigger state-level data protection laws and regulatory investigations. Compliance with these frameworks is a critical component of corporate governance in the event of a security incident.

While information about the shinyhunters group remains limited in the public domain, the scale of this claim necessitates caution. If the alleged data is verified, it may be advisable for affected users to update their passwords and enhance multi-factor authentication measures to secure their accounts. Organizations in the retail and e-commerce sectors, as well as media conglomerates, often implement defensive measures such as encryption, continuous monitoring, and strict access controls to mitigate these types of risks. However, once data has been exfiltrated, the focus often shifts to incident response and consumer notification to manage the fallout of the exposure.