Follett Software LLC listed by shinyhunters in data leak announcement

• Ransomware group: shinyhunters
• Country: United States
• Sector: Education
• Announcement date: April 30, 2026

The shinyhunters ransomware group has published a data leak announcement targeting Follett Software LLC. According to the claims made by the threat actor, the breach involves a significant amount of sensitive information, specifically alleging that over 4 million Salesforce records have been compromised.

The details of the claim

The shinyhunters group has listed data allegedly belonging to Follett Software LLC on their dedicated leak site. In the announcement, the threat actor has set a deadline of May 4, 2026, for the organization to make contact. While the group has taken responsibility for the listing, public information regarding the specific identity and operational history of this group remains limited.

Ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat actors then use the threat of leaking this stolen information on public forums or leak sites to pressure the victim into paying a ransom. This method increases the pressure on the target, as the loss of data confidentiality can lead to long-term consequences that persist even if systems are restored from backups.

Data involved in the alleged breach

The announcement claims that the compromised information includes a vast collection of records. Specifically, the group alleges that the stolen data consists of over 4 million Salesforce records. These records are said to contain both personally identifiable information (PII) and internal corporate data. Despite the scale of the claim, the threat actor did not provide any screenshots to substantiate the leak.

The specific types of data mentioned in the listing include:

• Personally identifiable information (PII)
• Salesforce records
• Internal corporate data

When organizations face such claims, it is common for them to conduct forensic investigations to determine the actual scope of the exposure. The presence of large-scale database records in a leak announcement suggests a targeted effort to access high-value information repositories within the corporate network.

About Follett Software LLC

Follett Software LLC is an educational technology company that provides library management, asset tracking, and digital content management software for K-12 educational institutions. It offers solutions that help schools digitize their operational processes.

Potential impact and organizational risks

The claims made by shinyhunters may pose a significant risk to the privacy of the organization's customer and employee data. Because Follett Software LLC is a US-based entity, a potential data breach could trigger legal processes under state-level data protection laws and sectoral regulations. The exposure of such data can lead to complex regulatory scrutiny and potential legal liabilities.

Furthermore, the leaked data could be utilized in identity theft or targeted phishing attacks. When personally identifiable information is exposed, malicious actors can use it to craft highly convincing social engineering campaigns, targeting individuals associated with the organization. Additionally, the exposure of internal corporate data may create secondary risks for supply chain security. In the modern digital ecosystem, a breach at a technology provider can have ripple effects across its entire user base, potentially impacting the security posture of the institutions that rely on their software.

To mitigate such risks, organizations in the educational technology sector often implement defensive measures such as multi-factor authentication (MFA), strict access controls, and continuous monitoring of data exfiltration patterns. Maintaining robust encryption for data at rest and in transit, alongside regular security audits, remains a fundamental component of a modern cybersecurity strategy designed to protect sensitive educational and corporate information.