Data breach
CFGI data breach
In 2026, CFGI suffered a data breach affecting 900,909 records. Exposed data included email addresses, names, surname and 3 other types of data.
Breach date
900 909
Records in the breach
6
Types of data exposed
Were you affected by the CFGI breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the CFGI breach
- Email Addresses
- Names
- Surname
- Phone Numbers
- Addresses
- Usernames
About the breach
In March 2026, the financial consulting and advisory firm CFGI suffered a data breach after being targeted in a "pay-or-leak" extortion campaign by the threat actor group ShinyHunters (linked by researchers to the UNC6661 / Scattered Lapsus$ Hunters cluster).
Breach Overview
• Date of Incident: March 2026
• Attacker / Campaign: ShinyHunters
• Exposed Data: The leaked dataset involved over 800,000 total records, including roughly 243,000 to 250,000+ unique email addresses, alongside full names, phone numbers, physical addresses, usernames, internal corporate metadata, and financial/advisory documents. Plaintext or hashed passwords were not reported as part of the core database leak.
• Public Tracking: The breach was added to platforms like Have I Been Pwned and XposedOrNot in June 2026.
Potential Risks & Recommended Actions
• Phishing & Social Engineering: Because the leak features corporate contact details, client/project context, and employee mappings, attackers may use the data for targeted spear-phishing or Business Email Compromise (BEC) attempts.
Breach Overview
• Date of Incident: March 2026
• Attacker / Campaign: ShinyHunters
• Exposed Data: The leaked dataset involved over 800,000 total records, including roughly 243,000 to 250,000+ unique email addresses, alongside full names, phone numbers, physical addresses, usernames, internal corporate metadata, and financial/advisory documents. Plaintext or hashed passwords were not reported as part of the core database leak.
• Public Tracking: The breach was added to platforms like Have I Been Pwned and XposedOrNot in June 2026.
Potential Risks & Recommended Actions
• Phishing & Social Engineering: Because the leak features corporate contact details, client/project context, and employee mappings, attackers may use the data for targeted spear-phishing or Business Email Compromise (BEC) attempts.
How to protect yourself
In order to protect yourself, we recommend the following:
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.