SHOULDVE_PAID_THE_FUCKING_RANSOM_Kemper-SHINYHUNTERS_.7z.001

Breach Overview

In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. According to the attackers, they gained access to Kemper's Salesforce environment through social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data that they claimed included internal directory data, Salesforce records, and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses, and partial payment card information, including the last four digits, expiration dates, and card brands. Kemper confirmed the incident and stated that they had engaged third-party cybersecurity experts and notified law enforcement.