Crunchbase data breach (January 2026): what Crunchbase confirmed
In January 2026 Crunchbase, the business-data platform, confirmed that an attacker had taken documents from its corporate network. Crunchbase says it holds SOC 2 Type II.
Short answer
Was Crunchbase hacked?
Yes. Crunchbase confirmed on 26 January 2026 that a threat actor exfiltrated certain documents from its corporate network, and said business operations were not disrupted.
ShinyHunters claimed more than 2 million records and posted files after a ransom was refused. The record count is the attacker’s claim.
Timeline at a glance
26 Jan 2026Crunchbase confirms documents exfiltrated from its corporate network. (Security Affairs)Confirmed
Jan 2026ShinyHunters claims 2M+ records and posts files. (Security Affairs)Unverified claim
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Crunchbase’s security posture at the time
What Crunchbase publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
SOC 2SOC 2 Type IIScope: Scope and audit period not published; Crunchbase’s help centre says it obtained SOC 2 Type II compliance.Source: Crunchbase — Data privacy & compliance
Scope vs breach. The published scope does not say whether the breached system was covered. The SOC 2 report’s system description is not public, so it is not possible to say whether the corporate document stores were in scope.
Size
Private, not disclosed
Listing: Private
Share price around the disclosure
Not listed.
Crunchbase incident timeline, in detail
Confirmed = acknowledged by Crunchbase, a regulator filing or a court. Reported = credible reporting Crunchbase has not fully confirmed. Unverified claim = an attacker or leak-site claim.
26 Jan 2026ConfirmedIdentity / corporate data
Documents exfiltrated from Crunchbase’s corporate network
What happened. Crunchbase confirmed that a threat actor exfiltrated certain documents from its corporate network and said business operations were not disrupted. ShinyHunters claimed more than 2 million records and posted files after a ransom was refused.
Impact. Corporate documents taken; Crunchbase says operations were not disrupted. People or records affected: Not disclosed by Crunchbase. ShinyHunters claims more than 2 million records (unverified).
Crunchbase publicly held SOC 2. Stated scope: Scope and audit period not published; Crunchbase’s help centre says it obtained SOC 2 Type II compliance. The published scope does not say whether the breached system was covered.
The way in was a person, not a server
Like most of 2026’s large data thefts, this one is described as starting with social engineering: a phished or voice-phished login, often to single sign-on, then bulk export from a SaaS application. Certification audits test that identity controls exist and operate; they do not promise that no employee or contractor will ever be talked out of a login.
What it means for Crunchbase Crunchbase customers and the companies profiled on it — and what to do
What Crunchbase’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Assume phishing follows the breach
Exposed contact details are used for convincing follow-up phishing. Warn staff and customers that genuine notices will not ask for passwords or payment.
2.Check your own help-desk and SSO flows
Require callback verification and phishing-resistant MFA for account and MFA resets; voice requests alone should never reset a login.
3.Ask the vendor what was exported, in writing
Ask which applications and fields were reached, the date range, and whether your organisation’s records were included.
Yes. Crunchbase confirmed on 26 January 2026 that a threat actor exfiltrated certain documents from its corporate network, and said business operations were not disrupted.
Did Crunchbase have SOC 2 or ISO 27001 certification?+
Crunchbase publicly held SOC 2. Stated scope: Scope and audit period not published; Crunchbase’s help centre says it obtained SOC 2 Type II compliance. The published scope does not say whether the breached system was covered.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Crunchbase. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout