Eye care company Alcon was named in a ShinyHunters "pay or leak" extortion campaign in August 2026. The group went on to publish the data, and Have I Been Pwned verified 218,395 unique email addresses in it, along with names, phone numbers and physical addresses. Have I Been Pwned describes the fields as largely corporate B2B contact data — so the people affected are mainly contacts at practices, clinics and suppliers rather than retail customers. Alcon has not publicly acknowledged the incident and appears not to have notified those affected, meaning anyone in the dataset will not hear about it from the company. Because the data was published rather than sold, it is freely available to anyone, and the combination of name, business address and phone number makes targeted calls and invoice phishing very convincing.
Reported affected: 218.395 / 218,395
Source: Have I Been Pwned ↗
Free, no signup. Runs against real breach databases.
You can require the company to tell you exactly what data it has about you, and give you a free copy. It has one month to answer.
You can require them to erase your personal data. Also one month, also free of charge.
If they ignore you or refuse without valid grounds, you can file a free complaint. Regulators can investigate and fine.
A leaked email and phone number don't just sit in one dump — data brokers buy breach data, merge it with public records, and resell it. That's why the spam calls and phishing texts keep coming months later. Deleting your data from the breached company is only the first step; getting it out of the broker network is what actually stops the follow-on damage.
Privora sends legally-backed GDPR erasure requests across the whole network, then re-checks so it stays gone.