Nexstar Media Group, one of the largest television broadcasting operators in the United States, is investigating a potential cybersecurity incident after the notorious ShinyHunters extortion group claimed to have stolen over 1.1 million Salesforce records and other internal corporate data. The threat actors have posted the company on their extortion portal and shared samples with cybersecurity journalists, marking the latest in a series of high-profile data theft campaigns targeting major organizations.
ShinyHunters Claims Theft of 1.1 Million Salesforce Records from Nexstar
On June 11, 2026, the ShinyHunters group listed “Nexstar.tv” on its extortion site, alleging the compromise of “over 1 million Salesforce records and other internal corporate data containing PII.” The posting was framed as a “final warning,” giving the company until June 14, 2026, to initiate contact before the data is publicly released. According to information shared directly with reporters, the intrusion occurred on June 6, 2026.
What Data Was Allegedly Stolen?
To substantiate their claims, the attackers provided screenshots and data samples that appear to originate from Salesforce exports and internal corporate repositories. The evidence shows approximately 1.1 million account entries, including contact records and user databases. Additionally, the threat actor claims to have accessed employee-related data, including names, email addresses, job titles, office locations, and organizational details associated with Nexstar personnel. The group further alleges access to more than 6,300 SharePoint files, totaling roughly 31 GB of internal data. It is critical to note that these claims have not been independently verified, and no data has been publicly leaked at the time of writing.
Nexstar Media Group operates nearly 200 television stations across numerous U.S. markets and owns national media assets including NewsNation and The CW Network. In response to a request for comment, a Nexstar spokesperson stated: “Nexstar is aware of reports of a potential IT security incident and is looking into it. There is no disruption to our operations.” The company has not confirmed that a breach occurred, and the allegedly stolen data has not yet been released.
Who Are the ShinyHunters?
ShinyHunters is a well-known cybercrime group linked to numerous high-profile data theft and extortion campaigns targeting organizations worldwide. The group typically pressures victims into negotiations by publishing breach claims and releasing samples of stolen data before conducting a full data leak. Their methods often involve exploiting vulnerabilities in cloud-based platforms, such as Salesforce, to exfiltrate large volumes of sensitive customer and employee information before demanding a ransom.
At the time of writing, the authenticity and full scope of the alleged Nexstar breach have not been independently verified. The situation remains under investigation, and further details may emerge as the June 14 deadline approaches.
What Affected Users Should Do Now
While Nexstar has not confirmed a breach, current and former employees, as well as individuals who may have interacted with the company’s Salesforce systems, should take proactive steps to protect their digital security. Change any passwords used across Nexstar-related accounts to strong, unique credentials. Enable two-factor authentication (2FA) on all accounts that support it, particularly email and corporate systems. Monitor financial and personal accounts for any signs of suspicious activity, including phishing emails or unauthorized login attempts. If you are a Nexstar employee, remain vigilant for targeted phishing campaigns that may use the stolen data to appear more convincing. For anyone concerned about their broader digital footprint, using a reputable no-log VPN service with AES-256 encryption and a kill switch can help protect your privacy, especially when accessing sensitive accounts from untrusted networks.
