ShinyHunters has claimed responsibility for a massive previously reported data theft involving managed services provider XTIUM, offering approximately 485.8 TB of alleged customer backups and corporate data for sale for $100,000.
The Sept. 5 post closely matches an XTIUM breach claim first covered by BreachNews in April, including the same alleged data volumes, Veeam infrastructure access and second compromise of a Synology ShareSync environment.
The new post therefore does not appear to describe a separate 485.8 TB breach. Instead, it provides the first direct public attribution of the previously reported dataset to ShinyHunters and shows the group attempting to monetize the alleged data months after it first surfaced.
ShinyHunters claims access to 480TB of customer backups
ShinyHunters claims approximately 480 TB of the data consists of virtual machine backups belonging to XTIUM customers and stored within the managed service provider’s Veeam environment.
The group alleges it gained and retained access to that infrastructure for approximately 8 months and could use Veeam’s file-level restore capabilities to inspect customer backup contents.
ShinyHunters further claims the environment contained backups belonging to XTIUM clients, creating potential downstream exposure beyond XTIUM’s own corporate data.
The group has not published a verified list of affected customers, and BreachNews has not independently established that the claimed 480 TB archive contains the data described.
Second intrusion allegedly added 5.8TB
The remaining 5.8 TB is allegedly associated with XTIUM and customer TeamShares obtained from a Synology ShareSync environment.
ShinyHunters claims this access was obtained in a second intrusion approximately 10 days after XTIUM was first notified of the earlier compromise and while negotiations were ongoing.
That account mirrors the timeline contained in the earlier April claim, where the actor alleged that a second compromise occurred after negotiations stalled.
At the time, screenshots reviewed by BreachNews appeared to show a Veeam backup environment containing hundreds of machines and approximately 480 TB of backups, along with a Synology ShareSync administrative interface containing multiple customer tenants.
The newly published ShinyHunters post substantially strengthens the connection between that earlier claim and the established extortion group, although BreachNews cannot independently determine whether ShinyHunters operated the earlier forum account or later acquired the dataset.
Data offered for $100,000
ShinyHunters is now offering the alleged XTIUM dataset for $100,000 and says prospective buyers can request samples.
The group is also attempting to pressure XTIUM customers directly, inviting organizations whose backups or shared files may be contained in the archive to negotiate for removal of their respective data.
That approach could broaden the extortion campaign from a single MSP to potentially affected downstream customers, a particularly serious risk when a service provider maintains centralized backups or infrastructure for numerous organizations.
BreachNews is not publishing the group’s contact information, underground forum links or access instructions for the allegedly stolen data.
XTIUM serves 1,700 customers
XTIUM, formerly ATSG, is a U.S.-based managed services provider formed through the combination of ATSG and Evolve IP’s U.S. business.
The company says it serves approximately 1,700 global customers and 950,000 end users, providing managed cloud, security, networking, virtual desktop, unified communications and other enterprise IT services.
The scale of XTIUM’s customer base makes the alleged theft of centralized virtual machine backups particularly concerning. If ShinyHunters’ claims are accurate, individual backup images could potentially contain data belonging to organizations across multiple industries rather than a single corporate environment.
XTIUM’s public status page also shows that the company operates Veeam Cloud Connect infrastructure for customers. On Aug. 26, XTIUM performed a scheduled upgrade to that environment, during which customers were temporarily unable to perform backups or restores. There is no public evidence connecting that maintenance to the breach claim.
Attribution changes earlier assessment
When BreachNews first covered the XTIUM claim in April, the actor behind the post had a limited forum history, making attribution and credibility difficult to assess despite detailed supporting screenshots.
The new ShinyHunters post changes that assessment by tying the same alleged dataset to a well-established data theft and extortion operation with a history of publicly releasing information when negotiations fail.
However, several important points remain unconfirmed. XTIUM has not publicly acknowledged the claimed 485.8 TB theft, confirmed that ShinyHunters accessed its Veeam or Synology environments, or identified affected customers.
BreachNews has also not independently verified that ShinyHunters currently possesses the full amount of data it claims to be selling.
XTIUM had not issued any public statement addressing the latest ShinyHunters post at time of publication.
