Kodak has acknowledged a security incident where unauthorized actors gained access to portions of its data and is now working with external cybersecurity experts to investigate the breach.

Established in 1880 as the Eastman Kodak Company and based in Rochester, New York, Kodak holds 79,000 global patents and supplies commercial printing solutions along with advanced materials and chemical products.

A company spokesperson informed BleepingComputer that the attackers obtained only a limited quantity of data during the event but did not respond to further questions about whether the company's internal network was compromised.

"Kodak recently discovered that an unauthorized third party illegally gained temporary access to a limited amount of company data. We promptly engaged external cybersecurity experts to support an investigation of what data was accessed and copied," Kodak stated.

"We are working with law enforcement and are confident there is no threat to our systems or operations. We will share additional updates as appropriate."

Although the company has not yet identified those responsible, the ShinyHunters extortion group has asserted responsibility via its dark web leak site.

The cybercrime group claims to have stolen more than 2.2 million records that include customer personally identifiable information along with internal corporate data and has threatened to release the stolen information on Thursday.

"Over 2.2 million records containing customer PII and other internal corporate data was compromised," they stated. "This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way."

While Kodak has not disclosed the method used by the threat actors to access its systems, ShinyHunters has also claimed responsibility for attacks on hundreds of Salesforce customers over the past year, alleging theft of over 1.5 billion records through Salesforce Aura and Salesloft Drift campaigns.

ShinyHunters has further been connected to security incidents at more than a dozen Snowflake customers and multiple other third-party integration providers.

One week ago the extortion group also claimed a new series of breaches at over 100 organizations including the University of Nottingham after data theft attacks that exploited a zero-day flaw in Oracle's PeopleSoft enterprise business software suite.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper