Desk live·
ForensicPost
Breaches/Identity/File 26-0616

ShinyHunters Claim 2.2 Million Records From Kodak

Around 2.2 million records were claimed from Kodak in June 2026. Long-lived brands accumulate customer records across decades and business models, and the estate rarely gets rationalised.

Constructed geometry · not a chart of case data
TargetKodak
ActorShinyHunters
S. Rosler7 min readConfidence: low1 source reviewed

Roughly 2.2 million records covering customer and corporate data were claimed from Kodak in June 2026, attributed to ShinyHunters. The figure originates with the group and is not corroborated.

The general pattern is worth a short file even where the specific claim is weak.

Decades Of Business Models, One Estate

A company with a long history and several strategic pivots accumulates customer data across all of them. Records from a consumer photography business, a commercial printing business and a chemicals business can sit in the same estate, collected under different terms, in different decades, under different regulatory regimes.

Nobody sets out to build that. It results from each transition prioritising the new line and migrating only what the new line needs, while the rest is retained on the reasonable-sounding grounds that deleting customer data might be a mistake.

The security consequence is that the organisation cannot answer the first question an incident poses — what do we hold — because the answer is distributed across systems whose owners have retired.

What would move this file: an acknowledgement, a stated affected population, or verification of a sample. None exists.

How we reported this

Compiled from public reporting, listed below. The record count originates with the attacking group. We did not review any listed data. Corrections: corrections@forensicpost.com.

Sources
  1. List of recent data breaches in 2026Bright Defense
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary