Topic
A cybercrime tactic in which attackers threaten to leak, sell, or expose stolen data unless a ransom is paid, often alongside file encryption.
Extortionists sent ASOS app users an apparently genuine ASOS push alert on October 6 claiming they had fully compromised the retailer's Snowflake instance. The alert is the only access anyone outside ASOS has seen; the entry route and any data taken are unknown.
Reality
ShinyHunters says a second PeopleSoft zero-day let it steal data on every FBI employee, a claim neither the FBI nor Oracle has confirmed. Two suspects have since been arrested, and PeopleSoft customers are still judging their own exposure from analysts' advice.
Reality
Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
11 publishersReality
Daniel Rhyne, a former infrastructure engineer, got 32 months in prison for using domain controller tasks to lock out 254 servers and 3,284 workstations. He staged it over 17 days of unauthorized access, and administrators learned of it from password-reset notifications after the tasks ran.
Reality
ShinyHunters claims it holds fitness-for-work medical records, including blood and urine results, on about 60,000 current and former FBI staff. Test results and home addresses cannot be reset like a password, so containment now depends on the files staying unpublished.
Reality
ShinyHunters claims data on almost every FBI agent, and samples reviewed by researchers show contact information, family details and duty assignments. The FBI has not confirmed what was taken or who took it, and says it is investigating.
Reality
ShinyHunters told 404 Media it will never publish its FBI haul, which it claims is 2 to 3 terabytes covering all employees and applicants. Keeping the files unpublished limits public exposure, but agents' home addresses, spouses' names and medical records are still with the group.
Reality
ShinyHunters says it will never publish or sell the 2TB to 3TB of FBI data it claims to hold and calls its one-week ultimatum a marketing campaign. The pledge leaves standing its unverified claim that an Oracle PeopleSoft zero-day got it in.
Reality
Army soldier Cameron Wagenius got 70 months in prison for extorting AT&T with call records taken from Snowflake accounts that lacked MFA. His group got in with exposed credentials alone, and AT&T's $370,000 ransom did not stop the leaks that followed.
Perspective Coverage
7 publishersReality
ShinyHunters is again exploiting Oracle PeopleSoft flaw CVE-2026-35273, getting past WAF rules by URL-encoding one letter of the path, Mandiant reported. The servers now in reach are the ones whose operators filtered the endpoint and never applied Oracle's patch.
Reality
ShinyHunters has shown journalists FBI medical exams that name agents and their addresses, from a set it says covers about 60,000 current and former staff. The FBI has so far confirmed only an incident in FBIJobs-related systems, and the group is threatening to publish within five days.
Reality
ShinyHunters says the two to three terabytes it took from the FBI include psychiatric and medical evaluations of bureau staff. Beside a Reuters sample tying named staff to counterintelligence jobs, those files are exposure no password reset can fix.
Reality
Cameron Curry got two years for extorting Brightly Software with stolen payroll data. The demand started one day after his contract ended, which is where the control gap sits.
Reality
ShinyHunters claims 623GB from a July social-engineering campaign and leaked part of it. Have I Been Pwned confirmed 1.6 million account records. Both the vendor and the crew can be telling the truth.
Perspective Coverage
3 publishersReality
BleepingComputer confirmed the attacker's text file and the defaced page on Clop's existing onion address. The full server access, the stolen source code and the Tor private key are still ShinyHunters' own account of it.
Reality
Latvian police say one man with an automated scanner and an anonymous mailbox turned two mid-sized company websites into an extortion business. Investigators linked the two cases on similarities in the methods used.
Perspective Coverage
3 publishersReality
The group told 404 Media it reached apply.fbijobs.gov through Oracle's PeopleSoft, and the FBI says the point of breach is still undetermined. Three of the bureau's recruiting pages have been serving error screens.
Reality
A hacker used a government employee's infostealer-compromised mailbox to send fraudulent requests to Revolut's Lithuanian subsidiary for about five months, and roughly 680 customers' passports and financial data went out.
Reality
Revolut says its core systems were never touched, and that staff approved fraudulent information requests because the sender's domain was genuine and the email authentication valid. It is applying for a deposit-taking licence in Israel.
Reality