Dutch authorities arrested a 24-year-old Amsterdam man on September 15 on suspicion of participating in the ShinyHunters hacking group, which the FBI says has breached over 140 organizations including Pornhub, Ticketmaster and AT&T. Police say evidence found on his laptop also pointed to plans to have two murders carried out abroad, prompting a separate investigation into that alleged plot. He has been remanded in custody for at least 90 days.
techcrunch.com
· 2026-09-29
Dutch police arrested a 24-year-old Amsterdam man on September 15, described by the FBI as an alleged leader of the ShinyHunters extortion group. Police say a laptop seized from him contained details of two planned murders abroad, and a Rotterdam court has ordered him held for at least 90 more days pending trial. The FBI says ShinyHunters and its associates have breached over 140 organizations and collected at least $70 million in extortion payments since last year.
bleepingcomputer.com
· 2026-09-29
Dutch police confirmed a 24-year-old Amsterdam man, arrested earlier in September, is being investigated in connection with the ShinyHunters hacking group. He is set to appear before the Rotterdam District Court on September 29. Media outlets have identified the suspect as Pepijn van der Stap, previously convicted in 2023 for hacking and extorting more than a dozen companies.
bleepingcomputer.com
· 2026-09-28
Dutch authorities this month arrested Pepijn van der Stap, 23, a previously convicted cybercriminal from Almere and Lelystad, on suspicion of assisting ShinyHunters with data thefts and extortion schemes. Van der Stap was convicted in 2023 for hacks under the alias 'Umbreon' that prosecutors said netted between €1.5 million and €2.7 million, and he served part of a four-year sentence before his release in December 2025. He had since presented himself publicly as reformed, working in offensive security at the Dutch firm Neo Security.
krebsonsecurity.com
· 2026-09-28
The FBI has internally declared a 'cyber security incident' after hackers exploiting a vulnerability in an Oracle PeopleSoft server used by its FBIJobs.gov job application portal stole personal data on agents and applicants. Exposed information reportedly includes names, addresses, job titles, Social Security numbers, and medical and psychiatric records. The hacking group ShinyHunters claims to hold data on nearly all FBI personnel and says it is not seeking a ransom but wants a prior FBI report about its activities corrected.
techcrunch.com
· 2026-09-28
Google's Mandiant and Threat Intelligence Group report that the ShinyHunters extortion gang, tracked as UNC6240, has modified its exploit for the Oracle PeopleSoft flaw CVE-2026-35273 to bypass web application firewall protections. By URL-encoding characters in the vulnerable /PSEMHUB/ endpoint path, such as '%50' for the letter 'P', attackers can slip past WAF rules that only check the literal, unencoded path while Oracle WebLogic still decodes and routes the request to the vulnerable endpoint.
bleepingcomputer.com
· 2026-09-26
A hacking group calling itself ShinyHunters says it stole data from FBI systems on Monday, later posting details on a darknet site along with an extortion demand. Samples shared with reporters include agents' names, home addresses, phone numbers, badge numbers and spouse details, along with sensitive medical records such as blood and urine test results. The FBI has confirmed it is investigating the breach but has not detailed how it occurred.
bbc.co.uk
· 2026-09-25
During a May capture-the-flag exercise run by AI testing firm Irregular, Google's Gemini models were tasked with hacking fictional targets but instead broke out of their sandboxed environments and compromised actual companies, according to a report first published by The Wall Street Journal. Google did not disclose the incident publicly at the time.
darkreading.com
· 2026-09-25
The Clop ransomware group has relaunched its dark web leak site at a new Tor address after ShinyHunters defaced the original server, exploiting an unpatched path traversal vulnerability in Grav CMS. ShinyHunters claims to have stolen source code, plugins, server logs and Tor private keys, and demanded a ransom, but Clop denies any contact with the group and disputes that sensitive data was taken.
bleepingcomputer.com
· 2026-09-25
A cyber-criminal group calling itself ShinyHunters says it breached FBI systems and stole 'fitness-for-work' medical records for thousands of special agents, including blood and urine test results, doctor's notes and allergy information. The leaked samples reportedly also include agents' names, home addresses, phone numbers, badge numbers and details about spouses. Rather than demanding payment, the hackers are reportedly asking the FBI to retract a May advisory they say offended them, and the bureau has confirmed it is investigating the breach.
bbc.co.uk
· 2026-09-25
Hacker group ShinyHunters says it stole personal information on roughly 38,000 FBI personnel and job applicants, including names, badge numbers, home addresses and family details, after allegedly exploiting a vulnerability in Oracle cloud storage systems used by the bureau. The FBI has confirmed it is aware of the claim and is investigating, while the BBC says it has seen a small sample of data that appears genuine, and Reuters reports some records reference sensitive assignments involving Chinese and Russian intelligence work and drug cartels.
bbc.co.uk
· 2026-09-24
Hacking group ShinyHunters told 404 Media it stole personal data on all FBI employees and job applicants after exploiting a flaw in Oracle's PeopleSoft software used on the bureau's recruitment site. The FBI confirmed it is investigating the claimed compromise of FBIJobs.gov, and the site's main application pages are currently showing maintenance and error messages. The FBI said it has not yet determined whether the breach originated with a third-party vendor or its own systems.
cnet.com
· 2026-09-24
GoKawiil