Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
7 publishers
- Builder
- Builder 21%
- Operator
- Operator 60%
- Investor
- Investor 19%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence62
Dutch police detained an alleged ShinyHunters leader on September 15, seven days before the group defaced the FBI's jobs website. The FBI says it is still chasing the rest of the group, so the vendor services and web portals it has used to get in remain the exposure to manage.
Perspective Coverage
3 publishers
- Builder
- Builder 13%
- Operator
- Operator 69%
- Investor
- Investor 18%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+25
- Incentives60
- Confidence58
ShinyHunters says it will never publish or sell the 2TB to 3TB of FBI data it claims to hold and calls its one-week ultimatum a marketing campaign. The pledge leaves standing its unverified claim that an Oracle PeopleSoft zero-day got it in.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+45
- Incentives70
- Confidence40
Kyle Spitze drew the maximum on every count, served consecutively, in a case that reached the FBI through a Discord referral. Escalation paths now feed maximum-penalty prosecutions.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+15
- Incentives60
- Confidence62
Justice says Chinese state operators laundered intrusions through infected routers and cameras in more than 130 countries since 2018. Source geography has been unreliable for years.
Perspective Coverage
7 publishers
- Builder
- Builder 32%
- Operator
- Operator 54%
- Investor
- Investor 14%
Reality
- Evidence66
- Adoption
- Insufficient
- Hype gap+18
- Incentives58
- Confidence64
Prosecutors in Kansas say the group crossed state lines to reach ATMs it believed were architecturally softer, which makes the machine on the street the control that mattered. The FBI counts 700 such incidents in 2025.
Perspective Coverage
4 publishers
- Builder
- Builder 29%
- Operator
- Operator 54%
- Investor
- Investor 17%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+20
- Incentives50
- Confidence65
The FBI says it is investigating unauthorized activity affecting FBIjobs.gov. 404 Media reports the intruders came in through an Oracle PeopleSoft applicant server and then reached a government cloud holding agent data.
Perspective Coverage
4 publishers
- Builder
- Builder 19%
- Operator
- Operator 69%
- Investor
- Investor 12%
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+35
- Incentives75
- Confidence60
The extortion crew defaced apply.fbijobs.gov on September 22 and told reporters it got remote code execution from a new Oracle PeopleSoft flaw, the same one it says it is now using against Fortune 500 targets. No technical details are public.
Perspective Coverage
14 publishers
- Builder
- Builder 20%
- Operator
- Operator 67%
- Investor
- Investor 13%
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+40
- Incentives75
- Confidence60
FBI Director Kash Patel suggested the bureau would target AI models built for crime after four companies disclosed agents that hacked other organizations. Nothing shows the models were built to hack, so the nearer fight is over lawsuits and the liability exemption the labs want.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+20
- Incentives60
- Confidence45
The group told 404 Media it reached apply.fbijobs.gov through Oracle's PeopleSoft, and the FBI says the point of breach is still undetermined. Three of the bureau's recruiting pages have been serving error screens.
Reality
- Evidence52
- Adoption40
- Hype gap+32
- Incentives72
- Confidence55
The bureau has not confirmed a breach and says it cannot yet tell whether its own systems or a third-party provider were the way in, while Reuters and 404 Media report that sample records match real personnel.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 63%
- Investor
- Investor 15%
Reality
- Evidence55
- Adoption45
- Hype gap+30
- Incentives80
- Confidence60
Their Lawfare essay says the architecture built after 9/11 now runs largely on data that companies gather for their own business, and it cites FBI Director Kash Patel's testimony that the bureau buys information on Americans from brokers.
Reality
- Evidence38
- Adoption35
- Hype gap+18
- Incentives62
- Confidence46
Bernhard Fritsch cut off his ankle monitor, was arrested in Mexico and released on a fortnightly check-in, then flew Lufthansa to Munich. Germany does not surrender its own nationals, so a wanted listing is what the case has left.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+12
- Incentives55
- Confidence62
Adebola Festus Adekunle and Mudasiru Afeez Olawale were picked up in Nigeria in 2023 and only now face charges in Mississippi and North Carolina. The gap is what cross-border reach costs in elapsed time.
Publishers:justice.gov
Reality
- Evidence52
- Adoption
- Insufficient
- Hype gap+30
- Incentives82
- Confidence58
Minnesota's 30-plus plants and the FBI's seven states point at small municipal operators, and at a suspected Iranian campaign that no longer looks opportunistic.
Reality
- Evidence58
- Adoption62
- Hype gap+10
- Incentives55
- Confidence52