Logitech Streamlabs Data Breach

ShinyHunters listed Logitech/Streamlabs on its dark web portal on August 18, 2026, adding one of consumer tech’s most recognizable brands to its active extortion portfolio. Logitech, headquartered in Switzerland, operates globally, and its Streamlabs subsidiary provides content-creation software to millions of live streamers. This listing places a prominent technology company and its subsidiary under the threat of extortion by the ShinyHunters group. In the 60 days preceding this listing, ShinyHunters claimed 15 other victims, primarily targeting organizations in the Technology, Healthcare, and Professional Services sectors. Their victims are predominantly located in the United States, Switzerland, and France. Recent targets have included Metabase, Lumenis Ltd., and RingCentral, Inc. Logitech’s extensive scale, vast user base, and digitally integrated product ecosystem make it an attractive target for threat actors seeking to amass a large collection of credentials.

SOCRadar’s stealer-log query for the domain logitech[.]com returned 18 records. These records were all classified as external consumer-account credentials associated with Logitech’s account management and support URLs. No corporate employee credentials were found within this specific data sample. All 18 identified records were logged on August 19, 2026, suggesting they were part of a single credential harvesting event. It is important to note that ShinyHunters typically does not rely on workstation-level stealer logs for their operations. Their modus operandi has historically involved large-scale credential abuse, direct database compromises, and social engineering tactics. Therefore, the presence of these customer credentials in stealer logs does not confirm that they were directly used in the extortion claim against Logitech. This telemetry should be treated as a parallel data point rather than definitive proof of an intrusion pathway. The absence of corporate employee credentials in this query does not rule out a potential compromise through other means. Organizations should continue monitoring dark web and stealer-log feeds for any related activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.