Charter’s breach matters because the weak point is not the telecom core. It is the employee identity that can open connected SaaS tools and let an attacker reach customer records from the inside of the trust chain. Charter confirmed a breach after ShinyHunters threatened to leak stolen data and said no sensitive PI or CPNI was exfiltrated. The group says it used a vishing-led Microsoft Entra compromise to export data from Charter’s Salesforce instance, which is the part that holds customer records, not network access systems. That splits the incident from a classic carrier outage or billing-system attack. Any company that lets one SSO account reach multiple cloud apps has the same exposure: a single stolen login can reach the data warehouse behind the business, even if the core network stays untouched.
Part of the PlainSec briefing for 2026-05-30