The ShinyHunters extortion group has listed Kimberly-Clark, the US consumer-goods manufacturer behind Kleenex, Huggies and Andrex, on its data-leak site, in a post dated 13 September 2026. Tracking data shows the group's leak site active through the weekend, with its most recent post recorded at 15:47 on 13 September and three posts in the last seven days.

The Kimberly-Clark listing carries no published sample, no record count and no stated data categories, and it is currently corroborated only by leak-site aggregators. No statement has been published by Kimberly-Clark, and no regulator or national CERT notification naming the company has been identified, which places the claim in the weakest category of this digest's breach triage: a dataset is being asserted to exist and to concern the company, which is materially different from evidence that the company's systems were compromised. ShinyHunters has a track record of large-volume claims that sometimes resolve as confirmed intrusions and sometimes as recycled or overstated datasets, and the group's name recognition makes its listings commercially useful to it independent of whether the underlying access is real.

The entry is recorded because a Fortune 500 consumer-goods manufacturer on a major leak site is material to retail supply-chain risk assessment, and because the correct response is to wait for the victim's own disclosure rather than treat the listing as an incident report.

Source

• RansomLook — ShinyHunters group