Eastman Kodak Company confirmed a data breach after the hackgroup ShinyHunters claimed 2.2 million records exfiltrated and set a same-day leak deadline. The company stated it believes there is no threat to its current systems or operations.
The breach was first reported Tuesday after ShinyHunters posted a data listing on their leak site. Kodak’s confirmation marks the first independent validation of the breach, moving it from an attacker’s unverified claim to a confirmed incident. The company engaged external cybersecurity forensics experts and notified law enforcement.
The compromised records include customer personally identifiable information and internal corporate data. Given Kodak’s diversified business spanning imaging technology, pharmaceutical packaging, and specialty chemicals, the scope of impacted data extends beyond consumer records to include industrial and B2B partner information.
What the Breach Reveals About Kodak’s Data Exposure
Kodak’s business has decades-spanning commercial relationships. The data exposed in this breach may include proprietary formulations, manufacturing processes, and long-term contracts spanning multiple industries.
ShinyHunters had set a June 18 deadline for the breach data, and the timing of Kodak’s confirmation alongside that deadline suggests the company was responding to pressure to address the disclosure publicly. The company’s statement that operations are not threatened was notable: an acknowledgment of the breach combined with a reassurance of operational continuity.
Regulatory Notification Obligations
The confirmation of the breach triggers mandatory breach notification obligations under applicable data protection laws in the jurisdictions where Kodak operates. The company’s diversified business footprint means the notification requirements may span multiple regulatory frameworks.
Kodak engaged external cybersecurity forensics experts following the incident, which is standard practice for confirmed breaches involving customer data and internal corporate records. Law enforcement notification has been completed.
