Kodak faces massive filtration and extortion by 2.2 million records

Kodak has confirmed that he is investigating unauthorized access to "a limited amount" of data and has hired external cyber security experts to determine what was copied and how it happened. Although the company insists that its systems and operations are not at risk, the extortion group known as ShinyHunters has published on its web dark leaks site a claim that claims to have exfiltered more than 2.2 million records with personal identifiable information (PII) of customers and internal corporate data, and threatened to publish them if Kodak did not contact before 18 June 2026.

The episode replaces on the table two realities that are no longer extraordinary: on the one hand, that even centenary companies with valuable assets and security resources can suffer gaps; and on the other, that specialized extortion groups take advantage of both direct failures and third-party vectors and cloud services to maximize their impact. ShinyHunters, whose activity and modus operandi are documented in public sources such as Wikipedia has been linked to numerous previous intrusions and the publication of large volumes of stolen data.

Beyond the media varnish, the real risk for Kodak customers and partners includes the possibility of fraud, identity supplanting and phishing campaigns directed with filtered personal data. For the company itself, the potential consequences range from regulatory penalties for data protection to loss of commercial confidence and significant remediation costs. The threat of extortion filtering also alters decision-making: to pay or not to pay does not guarantee the destruction of copies or prevent their resale in the clandestine market.

From the technical and management point of view, this type of incident often involves failures in more than one layer: committed credentials, excessive permits in SaaS integrations, lack of network segmentation or insufficient detection in EDR / SIEM tools. In addition, the forensic investigation must determine whether the attackers obtained direct access to internal systems or whether the exfiltration came from suppliers and third parties integrated into the company's digital ecosystem.

For companies and IT managers there are immediate and follow-up measures that reduce damage and accelerate recovery. It is appropriate to activate the incident response plan, preserve logs and evidence for forensic investigation, reset privileged credentials and force multifactor authentication where possible. In the medium term it is essential to review application permissions and service accounts, to segment critical networks, and to conduct integration audits with third parties to limit the chain break that allow campaigns such as those attributed to ShinyHunters.

At the legal and enforcement level, organizations should assess reporting obligations to regulators and clients according to jurisdiction, document measures taken and consider the provision of identity monitoring services to potentially affected persons. Coordination with security forces and the exchange of IoCs (indicators of commitment) with the incident response community can help to mitigate the re-use of credentials for other objectives.

Consumers and customers of affected companies can also take concrete steps: monitoring unusual communications, activating movement alerts in financial accounts, changing single passwords and reviewing credit protection offers if the companies concerned offer them. Individual prevention begins with mistrust of unsolicited emails and messages that use filtered data to make the deception more credible.

This event illustrates why organizations of all sizes should invest in the detection and simulation capabilities of attacks that test rules of IMS and EDR before an opponent does. Official resources and good practices, such as the guidelines on extortion and response to incidents published by agencies such as CISA or the NIST response criteria, offer practical road maps to coordinate mitigation, communication and recovery.

Finally, the strategic lesson is clear: cybersecurity is both technical and organizational. Resilience depends on governance that combines prevention, early detection, coordinated response and controls over cloud suppliers and services. For companies that depend on external integration and customer data, the priority is to reduce the attack surface and ensure that, when an incident occurs, the response is rapid, documented and aimed at protecting the people concerned and restoring the operation with transparency.