Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
7 publishers
- Builder
- Builder 21%
- Operator
- Operator 60%
- Investor
- Investor 19%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence62
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishers
- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Reality
- Evidence78
- Adoption
- Insufficient
- Hype gap+25
- Incentives45
- Confidence76
Montenegro extradited Turkish-Iranian Amir Barati to face US charges over a university hacking campaign that US officials say did $3.4 billion in damage. Where he chose to travel decided the case: police picked him up on holiday in Kotor, nine years after the charged hacking ended.
Perspective Coverage
4 publishers
- Builder
- Builder 15%
- Operator
- Operator 64%
- Investor
- Investor 21%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+25
- Incentives40
- Confidence72
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence40
The FBI and EPA's advisory I-073026-PSA blames a water-sector campaign across at least seven states on MicroLogix controllers left reachable on the open internet. The remedy they describe is network placement.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence35
Treasury's OFAC sanctioned 10 people over Ploutus ATM jackpotting, a scheme US officials tie to at least 1,500 attacks and $40.7 million in losses. Treasury calls the thefts a key revenue source for the Venezuelan criminal group Tren de Aragua.
Perspective Coverage
5 publishers
- Builder
- Builder 19%
- Operator
- Operator 56%
- Investor
- Investor 25%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+20
- Incentives55
- Confidence68
Vicksburg Mayor Willis Thompson says ransomware forced a shutdown of city systems that hit utility payments in the Mississippi city of more than 20,000. The city, still investigating, has not determined whether personal data on customers, employees or vendors was accessed.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence60
Pentagon officials are telling 2.8 million living people that hackers took their personnel records, occupational specialty included. At least 1.5 million of them are not on active duty, so the exposure reaches well beyond the active force a month after a similar FBI breach.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence64
Arizona's Supreme Court says hackers copied personal data on "many Arizonans," with no ransomware deployed and no ransom demand as of Monday. For the people in those records, the risk now is direct misuse of the data, and no extortion talks are under way to show what the thieves intend.
Publishers:azcourts.gov · therecord.media Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap0
- Incentives40
- Confidence50
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
Perspective Coverage
9 publishers
- Builder
- Builder 17%
- Operator
- Operator 68%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+30
- Incentives60
- Confidence64
FBI says ShinyHunters, which claimed the attack behind a nationwide learning-platform outage, may target students and families with threats and swatting. Its advice is to pay nothing and verify any contact through a channel already known.
Publishers:ic3.gov
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
ShinyHunters claims it holds fitness-for-work medical records, including blood and urine results, on about 60,000 current and former FBI staff. Test results and home addresses cannot be reset like a password, so containment now depends on the files staying unpublished.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+20
- Incentives65
- Confidence50
Fundsz operators Brian Early and Alisha Ann Kingrey must pay more than $31 million under a default judgment the CFTC announced on September 30. What investors actually recover depends on what the pair can pay, and the CFTC acknowledges that limit for orders like this one.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence70
FBI told staff in an internal memo to assume hacking group ShinyHunters stole data on every employee after a claimed 2 to 3 terabyte breach of FBIjobs.gov. Until the bureau confirms the scale, staff and the job applicants the hackers say are also in the files have reason to treat their home addresses as exposed.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+15
- Incentives70
- Confidence40
Arizona's Supreme Court says attackers copied over 150,000 foster-care review reports dating to 2010 from backups after an employee clicked a phishing link. The court kept those copies to recover from ransomware, so the store meant to survive an attack is the one that leaked.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives55
- Confidence45
Former airmen Chijioke Timothy Odimegwu and Harafat Mogaji got a combined 189 months in federal prison for BEC scams that diverted a $1.68 million wire. Their scheme worked wherever a payer accepted new bank details on the strength of an email.
Perspective Coverage
4 publishers
- Builder
- Builder 11%
- Operator
- Operator 68%
- Investor
- Investor 21%
Reality
- Evidence74
- Adoption
- Insufficient
- Hype gap0
- Incentives30
- Confidence78
Trung Nguyen Van faces a US money-laundering charge over crypto wallets that the DOJ says took in $53 million from fraud between 2018 and 2024. The trail was still good enough to charge him years later, and the department's own figures show the wallets forwarded nearly all of the money.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence55
Dutch police detained an alleged ShinyHunters leader on September 15, seven days before the group defaced the FBI's jobs website. The FBI says it is still chasing the rest of the group, so the vendor services and web portals it has used to get in remain the exposure to manage.
Perspective Coverage
3 publishers
- Builder
- Builder 13%
- Operator
- Operator 69%
- Investor
- Investor 18%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+25
- Incentives60
- Confidence58
ShinyHunters claims data on almost every FBI agent, and samples reviewed by researchers show contact information, family details and duty assignments. The FBI has not confirmed what was taken or who took it, and says it is investigating.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+25
- Incentives70
- Confidence40
ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.
Perspective Coverage
8 publishers
- Builder
- Builder 25%
- Operator
- Operator 58%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption
- Insufficient
- Hype gap+8
- Incentives58
- Confidence74
Earlier coverage
- ShinyHunters' no-leak promise leaves 2-3TB of stolen FBI data in its hands
Product · September 28, 2026 · 1 publisher
- ShinyHunters vows to withhold FBI employee files it has already used against one agent
Security · September 28, 2026 · 1 publisher
- ShinyHunters calls its FBI ultimatum a marketing campaign
Security · September 28, 2026 · 1 publisher
- ShinyHunters breaks into PeopleSoft systems that chose firewall rules over Oracle's patch
Leadership · September 28, 2026 · 2 publishers
- One URL-encoded letter gets ShinyHunters past PeopleSoft WAF rules on unpatched servers
Security · September 28, 2026 · 1 publisher
- ShinyHunters' leak samples expose named FBI agents' medical exams
Security · September 28, 2026 · 1 publisher
- Bitget presses Thorchain to shut out the hackers behind its $387.5 million loss
Leadership · September 26, 2026 · 1 publisher
- Meta ads steer Android users to fake Google Play pages carrying the RemControl banking trojan
Security · September 25, 2026 · 4 publishers
- Kiteworks asks customers to power down for nine hours to guard against zero-day attacks
Invest · September 27, 2026 · 3 publishers
- ShinyHunters says its FBI haul of up to three terabytes includes staff psychiatric records
Invest · September 26, 2026 · 1 publisher
- Iranian spyware hides command traffic in per-victim Telegram bots and commercial object storage
Build · September 26, 2026 · 1 publisher
- A contractor's six-month deal lapsed. The next day, a $2.5 million demand arrived
Security · August 14, 2026 · 2 publishers
- Medusa's patch window is negative: 500 victims, and exploits used before disclosure
Security · August 18, 2026 · 7 publishers
- Iran-linked PLC advisory widens past Rockwell, adds code-module tampering checks
Security · August 21, 2026 · 12 publishers
- 77 years, stacked: the 764 sentence that resets what a sextortion report is worth
Security · August 20, 2026 · 1 publisher
- ShinyHunters routes around PeopleSoft firewall rules to hit systems still missing Oracle's patch
Invest · September 26, 2026 · 1 publisher
- Kiteworks tells customers to shut down even internal file-sharing servers for six hours
Security · September 25, 2026 · 5 publishers
- Four days offline at a small UK plant, and the question stops being whether Iran can get in
Security · August 23, 2026 · 4 publishers
- At Boston Scientific, downtime is the leverage and hospitals hold the schedule risk
Security · August 26, 2026 · 8 publishers
- Feds say Siemens S7 controllers are already being probed, and the fix list is not a patch
Security · August 26, 2026 · 2 publishers
- AFP sizes the Shai-Hulud syndicate's take at more than 500,000 credentials
Security · August 28, 2026 · 17 publishers
- Quantum Systems reached CIA and FBI buyers through the investor the CIA created
Build · August 31, 2026 · 2 publishers
- Extortionists supply the only itemized count of what left Berlin's state network
Security · August 28, 2026 · 6 publishers
- Five jackpotting guilty pleas describe a crew that shopped for ATM models it could infect
Security · August 31, 2026 · 4 publishers
- Investigators sinkholed Sality's peer list to strand more than 15,000 infected Windows hosts
Security · September 2, 2026 · 8 publishers
- The counter scan that cleared a customer for entry is now for sale by name
Product · September 2, 2026 · 7 publishers
- FBI disrupts the Nanjing contractor that sold QScan and QTRouter to Chinese espionage operators
Security · September 1, 2026 · 2 publishers
- Nexus sells 153 million license scans that Krebs traces to a Louisiana IDV vendor
Security · September 1, 2026 · 7 publishers
- North Korea's WaterPlum fake-recruiter campaign has stolen $10.7 million from IT workers
Security · September 25, 2026 · 1 publisher
- CISA logged more than 100 compromised water systems in July, typically reached through cellular modems
Security · September 8, 2026 · 1 publisher
- NSA, CISA and FBI name six Chinese AI companies as industrial-scale distillers of US models
Security · September 8, 2026 · 8 publishers
- The FBI's first Cyber Strategy makes disruption the measure of a successful case
Security · September 10, 2026 · 2 publishers
- Garry Tan points regulators away from distillation days after agencies named six Chinese labs
Leadership · September 11, 2026 · 2 publishers
- IDScan.net's breach notice puts 153 million licenses in cloud accounts it kept after the check
Product · September 11, 2026 · 5 publishers
- A Conti developer got four years for holding stolen data from 12 of the group's 1,000-plus victims
Security · September 10, 2026 · 5 publishers
- Revolut handed over passports to a rogue account inside a real government domain
Security · September 12, 2026 · 8 publishers
- Group-IB ties the Handala Hack persona to a Telegram-run backdoor that steals saved passwords
Security · September 17, 2026 · 9 publishers
- Joint advisory pins WaterPlum's fake recruiters to North Korea's 313 General Bureau
Security · September 18, 2026 · 8 publishers
- CJIS v6.1 doubles the key strength required for criminal justice data outside secure locations
Security · September 21, 2026 · 2 publishers
- ShinyHunters reportedly pivoted from a recruiting server to FBI agent records
Product · September 22, 2026 · 4 publishers