In January 2026, business intelligence platform Crunchbase fell victim to a ShinyHunters “pay or leak” extortion campaign. After the demand was apparently not met, the stolen data was published publicly, exposing roughly 560,000 unique email addresses tied largely to sales leads and business contacts. The dump also contained names, physical addresses, phone numbers, job titles, employers, and LinkedIn profiles. Crunchbase has since confirmed that a threat actor exfiltrated documents from its corporate network.
While the leak doesn’t appear to include passwords, the richness of the exposed data makes it a potent resource for targeted phishing, social engineering, and business email compromise. Combining full names, employers, job titles, and LinkedIn profiles gives attackers everything needed to craft convincing impersonation and credential-harvesting lures against the exposed individuals and their organizations.
What to take away: Even breaches without credentials fuel identity-based attacks. Organizations whose staff appear in this dump should anticipate a rise in spear-phishing and reinforce verification controls and user awareness to blunt downstream account compromise.