CFGI Data Breach (June 2026)
CFGI, the Boston accounting and advisory firm, was targeted in a ShinyHunters pay or leak extortion campaign in March 2026, and Have I Been Pwned has verified 248,235 records of corporate contact information holding email addresses, names, employers, job titles, phone numbers and physical addresses.
- Organization
- CFGI
- Sector
- Professional services
- Country
- United States, MA
- Incident date
- March 6, 2026
- Disclosed
- June 18, 2026
- Records affected
- 248,000
- Attack type
- Undisclosed
- Threat actor
- ShinyHunters
- Status
- Confirmed
- Email addresses
- Employers
- Job titles
- Names
- Phone numbers
- Physical addresses
- ShinyHunters lists CFGI Management, LLC on its leak site with a final warning to reach out by March 9, 2026, claiming over 800k records, per ransomware.live. Have I Been Pwned gives the same date as the breach date.
- On the deadline set by the March 6 listing, ransomware.live records a second ShinyHunters listing, for CFGI Management (cfgi.com), claiming the company failed to reach an agreement with the group.
- Have I Been Pwned loads the verified breach with a count of 248,235 records, per its entry.
What Happened
Per the Have I Been Pwned entry, the financial consulting and advisory firm CFGI was the target of a ShinyHunters pay or leak extortion campaign in March 2026, and the group subsequently publicized data allegedly obtained from the firm. The entry characterizes that data as corporate contact information, including email addresses, names, phone numbers and physical addresses. CFGI's website describes a firm working across accounting, reporting, tax and compliance, with over 1,400 former Big Four professionals in over 30 offices across the Americas, Europe and Asia Pacific.
Ransomware.live recorded a ShinyHunters leak site listing for CFGI Management, LLC on March 6, 2026. The listing claimed that over 800k records containing personal information and other internal corporate data had been compromised, and gave the firm a final warning to reach out by March 9, 2026. A second listing, for CFGI Management (cfgi.com) and recorded on March 9, 2026, claimed the company had failed to reach an agreement with the group. Have I Been Pwned loaded the verified breach on June 18, 2026 with a count of 248,235 records.
What Was Exposed
6 classes of data across 248,235 records, per Have I Been Pwned, CFGI breach entry: email addresses, employers, job titles, names, phone numbers and physical addresses.
Names, employers, job titles, phone numbers and email addresses in one corporate contact set are what a fraudster needs to pose as a known finance contact and ask for a payment, a change of bank details or a login.
What to Do If You Are Affected
The full sequence, and what to do in what order, is in what to do after a data breach.
What Is Not Known Yet
How the data was taken, and whether the contact records belong to CFGI staff, clients or other business contacts.
Sources
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.