Checkout.com Discloses Data Breach After Extortion Attempt

According to DataBreaches[.]Net, Checkout[.]com disclosed a data breach after a known extortion attempt on 16 November 2025. The incident involved a legacy third-party cloud file storage system that had not been used since 2020 and did not affect its payment processing platform. The system was used for internal operational documents and merchant onboarding materials at the time, and attackers gained access to the legacy system which had not been decommissioned properly.

The company said it would not pay the ransom and instead would donate the amount to Carnegie Mellon University and the University of Oxford Cyber Security Center to support research in the fight against cybercrime. The report notes that the extortion attempt was linked to an attack by the group ShinyHunters, a claim reflected in the article.