FBI warned students in May of ShinyHunters harassment and swatting after a learning-platform attack
In a May 15, 2026 public service announcement, the FBI warned that ShinyHunters may target students and families with threats and swatting. The group had claimed the attack behind a nationwide learning-platform outage, and the bureau's advice was to pay nothing and verify any contact through a channel already known.
Publishers:ic3.gov
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence65
buildOne report1 publisher ShinyHunters-linked crews take Okta with a phone call and a rogue MFA device, Health-ISAC warns
Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Asos hackers reached Snowflake through an employee's login, City AM reports
Attackers who threatened millions of Asos customers got into its Snowflake-hosted data by posing as an employee's trusted contact, City AM reports. Its report names ShinyHunters for H&M alone among Asos, H&M and TFG, so a shared method across the three is unconfirmed.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
TFG London identified a cybersecurity incident on Sunday 11 October that hit IT systems at Phase Eight, Hobbs and Whistles. TFG says it has no reason to believe payment information is at risk, and the Independent counts it as the second UK retailer hack in a week.
Perspective Coverage
9 publishers
- Builder
- Builder 5%
- Operator
- Operator 68%
- Investor
- Investor 27%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence72
The FBI confirmed a contractor's failure to apply a critical Oracle PeopleSoft patch, CVE-2026-35273, led to a breach affecting thousands of employees. Any organisation that outsources PeopleSoft operations is exposed in the same way wherever its operator has not installed the fix.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence70
FBI drops Accenture as contractor over unpatched PeopleSoft that ShinyHunters breached
FBI dropped Accenture last week for failing to patch the Oracle PeopleSoft platform ShinyHunters breached, Reuters reported. Google separately says attackers hijacked the .as, .gh and .sl registries.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence45
FBI Director Kash Patel says agents arrested another ShinyHunters suspect, at least the third detained in two weeks since the FBIjobs.gov breach. The group says it is leaving Telegram as members are arrested, and it has promised not to publish the FBI staff data it stole.
Perspective Coverage
14 publishers
- Builder
- Builder 23%
- Operator
- Operator 57%
- Investor
- Investor 20%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+22
- Incentives68
- Confidence64
Air France-KLM confirms a breach the Asos attackers say is theirs
Air France-KLM confirmed to City AM that unauthorised access reached internal folders despite mandatory multi-factor authentication. The airline did not name an attacker, so the tie to Xuanye Group, the Asos claimant, rests on the group's own posts.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives65
- Confidence45
Intruders sat undetected in a Pentagon personnel file-transfer system for nine months
Unauthorized users stole data on about 3 million service members from the Defense Manpower Data Center and went undetected for nine months until July. A separate FBI breach surfaced weeks apart. Only the Pentagon case has a stated dwell time.
Publishers:this.weekinsecurity.com
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence50
Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
13 publishers
- Builder
- Builder 14%
- Operator
- Operator 74%
- Investor
- Investor 12%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence62
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence70
Anthropic says an alleged ShinyHunters member decompiled apps pulled from multiple stores and routed verified TruffleHog hits into a Telegram channel sorted by service, and those credentials opened most of his confirmed breaches.
Perspective Coverage
6 publishers
- Builder
- Builder 21%
- Operator
- Operator 57%
- Investor
- Investor 22%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence60
FBI said a contractor's failure to apply a security patch on a third-party platform let ShinyHunters steal personal details of thousands of bureau employees. The patch had already been issued, so the breach came down to one missed update on a platform the Bureau did not manage itself.
Perspective Coverage
11 publishers
- Builder
- Builder 24%
- Operator
- Operator 60%
- Investor
- Investor 16%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+20
- Incentives65
- Confidence66
SecurityWeek argues for in-call deepfake detection with help desk breaches it never ties to AI
SecurityWeek says awareness training has failed against help desk vishing, citing attacks that cost MGM an estimated $100 million. The fix it profiles is Netarx's live-call scanner for cloned voices and spoofed devices, but in both breaches it cites, callers talked help desk staff into granting access.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+45
- Incentives
- Not scored
- Confidence55
PeopleSoft zero-day claim behind the FBI breach rests on ShinyHunters' word alone
ShinyHunters says a second PeopleSoft zero-day let it steal data on every FBI employee, a claim neither the FBI nor Oracle has confirmed. Two suspects have since been arrested, and PeopleSoft customers are still judging their own exposure from analysts' advice.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+40
- Incentives60
- Confidence35
Defense Manpower Data Center is notifying people after intruders read unencrypted files on its server for nine months, exposing 2.76 million living people. Nine months of access means every file that server held over the period should be treated as copied.
Perspective Coverage
9 publishers
- Builder
- Builder 13%
- Operator
- Operator 81%
- Investor
- Investor 6%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives35
- Confidence68
Pentagon officials are telling 2.8 million living people that hackers took their personnel records, occupational specialty included. At least 1.5 million of them are not on active duty, so the exposure reaches well beyond the active force a month after a similar FBI breach.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence64
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
Perspective Coverage
9 publishers
- Builder
- Builder 17%
- Operator
- Operator 68%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence64
ShinyHunters threatens to publish FBI agents' medical records unless the bureau retracts a May advisory
ShinyHunters claims it holds fitness-for-work medical records, including blood and urine results, on about 60,000 current and former FBI staff. Test results and home addresses cannot be reset like a password, so containment now depends on the files staying unpublished.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives65
- Confidence50
FBI memo tells every employee to treat their personal data as stolen after the FBIjobs.gov breach
FBI told staff in an internal memo to assume hacking group ShinyHunters stole data on every employee after a claimed 2 to 3 terabyte breach of FBIjobs.gov. Until the bureau confirms the scale, staff and the job applicants the hackers say are also in the files have reason to treat their home addresses as exposed.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence40
Earlier coverage
- ShinyHunters defaced the FBI's jobs site a week after Dutch police held an alleged leader
Product · September 29, 2026 · Confirmed3 publishers
- ShinyHunters slips past PeopleSoft firewall rules by encoding one character
Security · September 26, 2026 · Confirmed8 publishers
- ShinyHunters calls its FBI ultimatum a marketing campaign
Security · September 28, 2026 · One report1 publisher
- ShinyHunters breaks into PeopleSoft systems that chose firewall rules over Oracle's patch
Leadership · September 28, 2026 · Confirmed2 publishers
- ShinyHunters' leak samples expose named FBI agents' medical exams
Security · September 28, 2026 · One report1 publisher
- RingCentral's platform held. Its customer records are on the internet anyway.
Security · August 14, 2026 · Confirmed3 publishers
- Trezor was not breached. 13,689 of its customers were.
Security · August 14, 2026 · Confirmed3 publishers
- ShinyHunters phished the firm that had just profiled it, and device trust was the only thing that mattered
Security · August 25, 2026 · Confirmed5 publishers
- McKesson's 8-K locates the stolen data inside third-party applications
Security · August 28, 2026 · Confirmed9 publishers
- Trezor says ShipMonk kept 67,000 customer records it had certified as deleted
Security · September 6, 2026 · Confirmed3 publishers
- Intruders reached Mathspace's unpatched Metabase four days after the fix shipped
Security · September 7, 2026 · Confirmed4 publishers
- Attackers phished Trezor, BitBox and CoinTracking customers through one shared newsletter provider
Security · September 10, 2026 · Confirmed4 publishers
- Florida traces the DAVID driver database breach to one Plant City police account
Security · September 11, 2026 · Confirmed2 publishers
- Anthropic widened its dual-use biology block on lost certainty about the old threshold
Build · September 10, 2026 · Confirmed5 publishers
- ShinyHunters says a Grav upload path let it deface Clop's leak site
Build · September 19, 2026 · Confirmed2 publishers
- ShinyHunters reportedly pivoted from a recruiting server to FBI agent records
Product · September 22, 2026 · Confirmed3 publishers
- ShinyHunters pins its claimed FBI breach on an unpatched PeopleSoft RCE
Security · September 23, 2026 · Confirmed14 publishers
- ShinyHunters claims 2 to 3 terabytes of FBI personnel data from an Oracle PeopleSoft flaw
Leadership · September 23, 2026 · Confirmed3 publishers
- ShinyHunters claims the private keys to Clop's onion address after defacing the leak site
Security · September 19, 2026 · Confirmed6 publishers
- AdaptHealth traces a 4.1 million-record breach to one compromised contractor session
Security · September 12, 2026 · Confirmed2 publishers