ShinyHunters Breached American Tower: 5.2M Records, Cell Tower GPS Codes

ShinyHunters claimed responsibility on June 12, 2026 for a ransomware attack on American Tower Corporation, the largest owner of cellular infrastructure in the United States, and demanded payment before leaking more than 5.2 million stolen records. The exfiltrated data includes customer and landowner PII, tower asset records with GPS coordinates, and plaintext physical access and gate codes for cell tower compounds across the country. The breach was confirmed via Have I Been Pwned on June 26, which added 216,601 verified account records.

Who Is ShinyHunters

ShinyHunters is a financially motivated cybercriminal group first identified in 2020. They have been responsible for some of the largest data breaches of the past five years, including Ticketmaster (560 million records, 2024), Santander Bank, and Snowflake customer breaches affecting dozens of enterprises. The group operates an extortion model: steal data, issue a deadline, and leak or sell if the ransom is not paid. Their June 2026 activity also targeted Nexstar Media Group, the largest US television broadcaster, and the Council of Europe.

What Data Was Stolen

The most alarming element of the American Tower breach is not the PII — it is the operational data. Tower asset records with GPS coordinates tell you exactly where every cell tower is. Plaintext physical access and gate codes tell you how to open them. Combined, this data provides a blueprint for physical interference with US cellular infrastructure: an adversary with this dataset knows the location and entry code for towers that serve T-Mobile, Verizon, AT&T, and other carriers. American Tower's portfolio covers more than 40,000 tower sites in the United States alone.

Why Telecom Infrastructure Data Is Especially Sensitive

Cell towers are not just communication infrastructure — they are the backbone of emergency services, military communications, and financial transaction networks. GPS spoofing and tower interference have been documented tactics in conflict zones; having the precise location and physical access credentials for US tower sites represents a different category of exposure than typical enterprise data breaches. The data also includes records tied to T-Mobile, Verizon, and the US Department of Homeland Security, which had assets managed by or co-located with American Tower facilities.

The Ransom Deadline and Aftermath

ShinyHunters issued a June 15 deadline warning to American Tower before the planned data leak. American Tower has not publicly confirmed whether a ransom was paid. The June 26 HIBP addition of 216,601 records suggests at least a portion of the stolen data was made public or shared with breach notification services regardless of outcome. American Tower filed an 8-K with the SEC in FY2026, the mandatory disclosure for material cybersecurity incidents, confirming the breach reached the threshold for investor notification.

The Nexstar and Other ShinyHunters Targets

June 2026 was an active month for ShinyHunters. The group simultaneously threatened Nexstar Media Group — which owns 200+ local television stations and delivers news to roughly 68% of US television households — with a similar data extortion campaign. The pattern suggests the group is running parallel multi-target campaigns, extracting maximum leverage across industries rather than focusing resources on a single high-value target. JCPenney was also among the threatened organizations.

Our Analysis

The plaintext gate codes component of the American Tower breach deserves more attention than it has received. Every major ransomware breach leaks PII, and PII has largely become a commodity in breach economics. Physical access credentials to telecommunications infrastructure are categorically different: they can be acted on offline, cannot be remotely revoked easily across thousands of sites, and have no expiration date built in. American Tower will need to rotate gate codes across tens of thousands of sites, a logistical operation that takes months. Until that rotation is complete, the codes that were stolen are still valid at the towers that have not been updated. For developers and enterprises depending on cellular connectivity, this is a reminder that the physical layer of network infrastructure has the same attack surface as software systems.

Key Takeaways

• ShinyHunters breached American Tower on June 12, 2026: 5.2 million records stolen, ransom deadline June 15
• Critical data stolen: GPS coordinates and plaintext physical gate codes for 40,000+ US cell tower sites
• Records tied to T-Mobile, Verizon, and US DHS were among the compromised data
• 216,601 accounts confirmed on HIBP as of June 26; SEC 8-K filed confirming material cybersecurity incident
• For developers: cellular redundancy planning should assume tower-level physical disruption is a credible threat vector post-breach
• What to watch: American Tower's timeline for rotating physical access codes across its US tower portfolio