Checkout.com Discloses Data Breach After Extortion Attempt

Checkout[.]com has disclosed a data breach after an extortion attempt, the company saying the incident involved a legacy, third-party cloud file storage system that had not been used since 2020 and did not affect its payment processing platform. According to Checkout, the attackers gained access to this third-party legacy system, which was used for internal operational documents and merchant onboarding materials at the time.

The firm emphasised that the attackers did not access merchant funds or card numbers and has launched an investigation to determine the scope and identify affected entities, while reporting the incident to law enforcement and relevant regulators. The extortion claim was made by the ShinyHunters group, which emerged in 2020 and reportedly joined forces with Scattered Spider earlier this year; SecurityWeek notes that the groups have announced retirements or new offshoots in related campaigns.

Checkout said it would not pay the ransom and would instead donate the ransom amount to Carnegie Mellon University and the University of Oxford Cyber Security Center to support research in the fight against cybercrime. The disclosure was published on 14 November 2025.