Threat Intelligence
Get the briefing
Threat Intelligence

FBI Breach Claim, Hijacked Leak Site and 153 Million ID Scans: September 2026 in Review

SOCRadar · 28 Oct 2026
Key Takeaway Check that your suppliers and contractors apply security patches promptly, because their mistakes can expose your data.

September 2026 saw attacks on federal law enforcement, a rival cybercrime gang and the companies that verify identities. ShinyHunters hijacked the Clop ransomware gang's Dark Web leak site and, four days later, claimed a breach of the FBI. Identity data drove the month's biggest numbers, led by a data breach linked to a Dark Web service advertising more than 153 million driver's license scans.

On September 22, ShinyHunters said it had stolen data on bureau employees and job applicants, and the FBIJobs.gov recruitment site displayed a "seized by ShinyHunters" banner and went offline. The group claimed it took 2 to 3 TB of data and shared about 5,000 purported employee records with reporters, who verified parts of the set. Its claim that it is using the same weakness against Fortune 500 companies remains unverified.

The FBI's account points to a missed patch. On October 5, its Cyber Division said a contractor had failed to apply an available patch and had been removed. On October 9, Director Kash Patel said the intrusion occurred on a third-party vendor's platform and announced the arrest of another suspected ShinyHunters co-conspirator. The roundup also notes that AI agents moved into real campaigns, with one actor using hundreds of agents to compromise 395 organisations. This summary covers only the opening of the report.

ShinyHunters data breach third-party risk identity data AI threats
Read original source -> Breached? Get incident response
Answering to more than one framework? Run them as one security and AI governance programme ->

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.