American Tower Data Breach (June 2026)
Telecommunications tower infrastructure company American Tower was the target of a ShinyHunters pay or leak extortion campaign in June 2026. Have I Been Pwned has verified 216,601 email addresses from the published data, belonging to employees, contractors, customers and leads, along with names, job titles, physical addresses and phone numbers.
- Organization
- American Tower
- Sector
- Telecoms
- Country
- United States, MA
- Incident date
- June 12, 2026
- Disclosed
- June 26, 2026
- Records affected
- 217,000
- Attack type
- Undisclosed
- Threat actor
- ShinyHunters
- Status
- Confirmed
- Email addresses
- Job titles
- Names
- Phone numbers
- Physical addresses
- ShinyHunters lists American Tower Corporation on its leak site, per ransomware.live's record of the listing. Have I Been Pwned records this as the breach date.
- The deadline the group's June 12 listing gives American Tower to make contact before the data is leaked, per ransomware.live's record of the listing.
- Have I Been Pwned adds the breach, covering 216,601 unique email addresses, per its entry, and TechNadu reports the load the same day.
What Happened
Per the Have I Been Pwned entry, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters pay or leak extortion campaign in June 2026, and the group went on to publish data allegedly taken from the company. Have I Been Pwned counts 216,601 unique email addresses in that data and describes them as belonging to employees, contractors, customers and leads, with names, addresses and phone numbers also exposed.
ShinyHunters listed American Tower Corporation on its leak site on June 12, 2026, according to ransomware.live's record of the listing. The listing claims over 5.2 million records, including customer and landowner personal information, records it says are tied to other organizations, tower asset records with GPS data and physical access codes, and internal corporate data. It gave American Tower until June 15, 2026 to make contact before the group leaked the data.
Have I Been Pwned added the data on June 26, 2026, and TechNadu reported the load the same day.
What Was Exposed
5 classes of data across 216,601 records, per Have I Been Pwned, American Tower breach entry: email addresses, job titles, names, phone numbers and physical addresses.
Names, job titles, email addresses, phone numbers and physical addresses for a company's employees, contractors, customers and leads are what an attacker needs to impersonate a colleague, a supplier or American Tower itself in a request to pay an invoice or change bank details.
What to Do If You Are Affected
The full sequence, and what to do in what order, is in what to do after a data breach.
What Is Not Known Yet
How the group got access, whether American Tower is notifying the people in the data, and whether the tower asset records and access codes the group's listing describes were among the files it published.
Sources
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.