Ransomware Leak
shinyhunters
National Railroad Passenger Corporation (amtrak.com)
Data leak attributed to shinyhunters, first discovered on 2026-04-12. Approximately 15,891,884 records were reported exposed.
Threat group
shinyhunters
Records exposed
15,891,884
Discovered
2026-04-12
Country
US
Indexed
2026-08-21
Website
amtrak.com
Source ID
28080
About this leak
Over 9.4M Salesforce records containing PII and other internal corporate data have been compromised. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 11 Apr 2026 | Warning: FINAL WARNING PAY OR LEAK
What is inside this leak sample
Indexed records
15,891,884
With email
•••
ID documents
•••
File types
•••
Corporate vs personal email
21.34% corporate · 78.66% personal
Top corporate email domains
% of corporate emails
amtrak.com
18.79%
amtrak.com.amtrakepw
6.38%
6 more hidden ·
Enterprise
Analysed 2026-09-01
More leaks attributed to shinyhunters
Worried your information is in this or another leak?
Run a free, anonymous search
across millions of ransomware and infostealer records.