Russian authorities have arrested three of the four suspected members of DataSuckers in the Dodo Pizza investigation, Risky.Biz and Nasha Niva report. Police tracked a 19-year-old from Barnaul through his home IP address, according to Risky.Biz.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 57%
- Investor
- Investor 23%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence60
Leaked Luna Moth files show one operator on the phone while a second drives the remote session
Check Point's October 9 analysis of leaked Luna Moth files describes one operator calming the victim by phone while another runs the remote session. The files surfaced on an anonymous onion site and Check Point words its conclusion conditionally, so the call pattern is usable for training but unverified.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
iRhythm, maker of the Zio patch, says attackers who social-engineered access to third-party-hosted apps took data on at least 360,000 patients. The records link patients' insurance numbers to their device serial numbers, enough detail for a caller to pass as the company.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence68
In an unverified leak, Luna Moth's callers keep victims talking while a partner runs the remote session
Luna Moth's leaked vishing playbook, which has not been verified, coaches callers to keep victims calm while a second operator works their machine, Check Point reported. The method needs no new malware, only a phone call and a legitimate remote-support tool, so the defense sits at the help desk.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence45
Extortionists sent ASOS app users an apparently genuine ASOS push alert on October 6 claiming they had fully compromised the retailer's Snowflake instance. The alert is the only access anyone outside ASOS has seen; the entry route and any data taken are unknown.
Perspective Coverage
11 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+40
- Incentives60
- Confidence68
Apparent hackers sent an extortion note through ASOS's app to UK customers, claiming to have "fully compromised" its Snowflake instance. ASOS has not confirmed a breach, so the only compromise anyone has seen is that outsiders could message its app users.
Perspective Coverage
15 publishers
- Builder
- Builder 21%
- Operator
- Operator 55%
- Investor
- Investor 24%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap−15
- Incentives66
- Confidence70
Texas's attorney general puts the breach of Oracle Health's legacy Cerner systems at nearly 20 million people, according to Bloomberg. Oracle has not confirmed the figure, far above the counts in earlier state filings and patient notices.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 47%
- Investor
- Investor 31%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence60
Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
13 publishers
- Builder
- Builder 14%
- Operator
- Operator 74%
- Investor
- Investor 12%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence62
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence70
Group-IB traces ASOS's rogue push alert to a renamed gaming-trade Telegram account
Group-IB found the Telegram channel in ASOS's October 6 rogue push alert was opened that day by an account once used for gaming-item trading. Until data surfaces, the Snowflake claim is unproven and the abused messaging platform is the lead to work.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence50
Hackers delivered their Asos extortion demand through the retailer's own app
Hackers used the Asos app on Tuesday to send UK users an extortion demand claiming they had compromised the retailer's Snowflake instance. Because the demand went to shoppers, the attackers decided when Asos had to speak to customers, before it could say what data, if any, was taken.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives65
- Confidence40
DataSuckers answers ATB's breach denial with samples of allegedly stolen data
DataSuckers demanded $400,000 from ATB, Ukraine's largest grocer, claiming records on 7.9 million customers that the company denies were compromised. The samples it posted on Telegram are the only public evidence against ATB's statement that its data is protected.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+30
- Incentives75
- Confidence45
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishers
- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+25
- Incentives45
- Confidence76
buildOne report1 publisher Investigators say KillSec got in through weak cloud storage, unpatched software and bought logins
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence40
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
Perspective Coverage
9 publishers
- Builder
- Builder 17%
- Operator
- Operator 68%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence64
Dutch police detained an alleged ShinyHunters leader on September 15, seven days before the group defaced the FBI's jobs website. The FBI says it is still chasing the rest of the group, so the vendor services and web portals it has used to get in remain the exposure to manage.
Perspective Coverage
3 publishers
- Builder
- Builder 13%
- Operator
- Operator 69%
- Investor
- Investor 18%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence58
DataSuckers prices a claimed 68 million Dodo Pizza records at $100,000
Dodo Pizza confirmed hackers accessed customer names, addresses, birth dates and order details, while the DataSuckers group claims 68 million records. How many of its customers across 28 countries are affected rests, for now, on the attackers' word.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives70
- Confidence50
ShinyHunters' no-leak promise leaves 2-3TB of stolen FBI data in its hands
ShinyHunters says it will never publish the 2-3TB of FBI data it took, allegedly through the agency's online jobs board. The agents whose records were taken still have to plan as if the files are loose, because the pledge covers only publication.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives75
- Confidence40
Mandiant says ShinyHunters has planted web shells on dozens of Oracle PeopleSoft systems by URL-encoding one character to get past firewall rules. Employers that treated June's stopgap as the fix now have to patch and also look for any access the attackers left behind.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+8
- Incentives20
- Confidence70
Kiteworks told customers to shut its file-transfer servers for nine hours this weekend after a federal warning. The company says its current release fixes every known flaw, so the outage guards against one it does not know about.
Perspective Coverage
3 publishers
- Builder
- Builder 12%
- Operator
- Operator 63%
- Investor
- Investor 25%
Reality
- Evidence60
- Adoption50
- Hype gap+25
- Incentives65
- Confidence55
Earlier coverage
- ExfilSquad's 382GB haul may trace to one Power Pages permission, not malware
Security · August 14, 2026 · Confirmed2 publishers
- The extortion layer your IR playbook has no page for: 'Ransom Busters' emails victims mid-incident
Security · August 18, 2026 · Confirmed3 publishers
- Apollo's California filing puts Social Security numbers into the private equity attack wave
Security · August 21, 2026 · Confirmed2 publishers
- ShinyHunters phished the firm that had just profiled it, and device trust was the only thing that mattered
Security · August 25, 2026 · Confirmed5 publishers
- Extortionists supply the only itemized count of what left Berlin's state network
Security · August 28, 2026 · Confirmed6 publishers
- McKesson's 8-K locates the stolen data inside third-party applications
Security · August 28, 2026 · Confirmed9 publishers
- MAG's car park and airport Wi-Fi systems gave up 8.7 million identity records
Security · August 28, 2026 · Confirmed6 publishers
- PREY-0058 phones executives to harvest Microsoft 365 session tokens
Security · September 7, 2026 · Confirmed3 publishers
- Hackers priced 680 Revolut customer files at roughly $4,300 each
Invest · September 17, 2026 · Confirmed3 publishers
- A compromised government email account pulled about 680 customer files out of Revolut over months
Invest · September 19, 2026 · Confirmed2 publishers
- ShinyHunters pins its claimed FBI breach on an unpatched PeopleSoft RCE
Security · September 23, 2026 · Confirmed14 publishers
- ShinyHunters claims 2 to 3 terabytes of FBI personnel data from an Oracle PeopleSoft flaw
Leadership · September 23, 2026 · Confirmed3 publishers
- ShinyHunters claims the private keys to Clop's onion address after defacing the leak site
Security · September 19, 2026 · Confirmed6 publishers
- AdaptHealth traces a 4.1 million-record breach to one compromised contractor session
Security · September 12, 2026 · Confirmed2 publishers