ZenBusiness Data Breach March 2026 - What Was Exposed and What To Do

What Happened

In March 2026, the hacker and extortion group "ShinyHunters" claimed to have obtained a substantial corpus of data from ZenBusiness, a business formation and compliance platform. The group claimed the data had been exfiltrated from platforms including Snowflake, Mixpanel and Salesforce, and threatened to publish it if a ransom was not paid. The following month, after claiming payment had not been made, ShinyHunters publicly released the data. The collection amounted to many terabytes across thousands of files that appeared to originate from multiple systems and business functions, including leads, support records and other CRM-related data. The data contained approximately 5M unique email addresses, often accompanied by name and phone number depending on the source file.

Breach date

2026-03-27

Records affected

5,118,184

Verified

Yes

Domain

zenbusiness.com

What Was Exposed

The following data types were included in the breach:

• Email addresses
• Names
• Phone numbers

What You Should Do

If you had an account with ZenBusiness, take these steps immediately:

1. Check if your account was affected at HaveIBeenPwned.com
2. Watch for phishing emails that reference the breach or impersonate the affected company
3. Be alert for social engineering attempts using your exposed personal information
4. Enable two-factor authentication on the affected service if available
5. Consider using a password manager to generate unique passwords for each service

FAQ