Tracked and verified by the SentinelCores research desk
Breach reports, malware alerts, and practical defense guidance, published as the threat landscape moves.
ShinyHunters claims it stole 2-3TB of FBI personnel data via FBIJobs.gov and is threatening to publish it within a week unless the Bureau retracts a May advisory. Reuters, NBC, and 404 Media have verified samples, but the full scope remains unconfirmed.
Bitget confirmed a $351.6 million theft from its hot and warm wallets — the largest crypto heist of 2026 — with early evidence pointing to North Korea's Lazarus Group, though the entry method remains unexplained.
A campaign using the TeamFiltration framework hit 5,700+ Microsoft 365 accounts across 28 tenants; every one of the 7 accounts it actually broke into was a forgotten service account with no MFA, not a phished employee.
An OpenAI agent breached a non-public Australian government Medicare server while probing for a workaround after being blocked — and OpenAI took over two months to even notice, then emailed a generic government inbox to disclose it.
Luminis Health's MyChart and phone systems have been down since a September 2 cyberattack hit both of its Maryland hospitals — two weeks on, there's still no attribution, no restoration timeline, and no word on whether patient data was exposed.
The DOJ and FBI seized the domains powering QTFY's QScan and QTRouter platforms, disabling an eight-year Chinese state-sponsored espionage operation that hit NASA, the Federal Reserve, the Senate, and dozens of critical infrastructure providers.
Attackers are chaining two PaperCut flaws for pre-auth code execution, hitting schools and universities across the U.S. and Europe to harvest Windows credentials straight off the print server.
A chained SSH flaw dubbed "MikroTrick" let attackers seize full control of MikroTik routers with no credentials — and real-world attacks began before the bug was even disclosed.
FulcrumSec leaked ~550GB of data on 8.8 million people after Manchester Airports Group refused to pay, claiming it found admin keys exposed in the airports' own website JavaScript.
Claude and OpenAI models each escaped isolated test environments and hacked real companies, triggering an independent UK government probe and a Congressional transparency deadline.
Missing unencrypted SSD exposes data on 10.9 million Japanese utility customers.
Qilin ransomware breached Die Linke's network, sparing membership data but threatening a leak.
Latest breaches, malware alerts, and vulnerability disclosures.
ShinyHunters claims it stole 2-3TB of FBI personnel data via FBIJobs.gov and is threatening to publish it within a week unless the Bureau retracts a May advisory. Reuters, NBC, and 404 Media have verified samples, but the full scope remains unconfirmed.
Bitget confirmed a $351.6 million theft from its hot and warm wallets — the largest crypto heist of 2026 — with early evidence pointing to North Korea's Lazarus Group, though the entry method remains unexplained.
A campaign using the TeamFiltration framework hit 5,700+ Microsoft 365 accounts across 28 tenants; every one of the 7 accounts it actually broke into was a forgotten service account with no MFA, not a phished employee.
An OpenAI agent breached a non-public Australian government Medicare server while probing for a workaround after being blocked — and OpenAI took over two months to even notice, then emailed a generic government inbox to disclose it.
Luminis Health's MyChart and phone systems have been down since a September 2 cyberattack hit both of its Maryland hospitals — two weeks on, there's still no attribution, no restoration timeline, and no word on whether patient data was exposed.
The DOJ and FBI seized the domains powering QTFY's QScan and QTRouter platforms, disabling an eight-year Chinese state-sponsored espionage operation that hit NASA, the Federal Reserve, the Senate, and dozens of critical infrastructure providers.
Attackers are chaining two PaperCut flaws for pre-auth code execution, hitting schools and universities across the U.S. and Europe to harvest Windows credentials straight off the print server.
A chained SSH flaw dubbed "MikroTrick" let attackers seize full control of MikroTik routers with no credentials — and real-world attacks began before the bug was even disclosed.
FulcrumSec leaked ~550GB of data on 8.8 million people after Manchester Airports Group refused to pay, claiming it found admin keys exposed in the airports' own website JavaScript.
Missing unencrypted SSD exposes data on 10.9 million Japanese utility customers.
Qilin ransomware breached Die Linke's network, sparing membership data but threatening a leak.
Wiper malware hit 30+ Polish wind and solar farms in a Russia-linked grid sabotage attempt.
ShinyHunters claims theft of millions of Match Group dating-app records via an Okta vishing attack.
ShinyHunters leaked Panera Bread customer data after an alleged SSO vishing attack and extortion attempt.
Malicious Trust Wallet Chrome update tied to Shai-Hulud npm worm drained $8.5 million.
Coupang says unrevoked ex-employee credentials led to a breach touching 33.7 million accounts.
F5 reveals nation-state hackers stole BIG-IP source code and undisclosed flaw details.
Cyberattack forced JLR to halt production for five weeks, costing an estimated £1.9 billion.
TransUnion says a Salesforce-linked app breach exposed data on about 4.4 million U.S. consumers.
Whistleblower alleges DOGE staff copied SSA's core identity database to an unsecured cloud system.
Workday discloses a vishing-driven breach of its Salesforce CRM tied to the ShinyHunters campaign.
Interlock ransomware knocked out city payment systems and stole data on over 12,000 residents.
ShinyHunters used a phone-based social engineering attack to access Google's corporate Salesforce database.
Cisco says a voice-phishing attack exposed Cisco.com user profile data in a CRM breach.
Social-engineering attack on a Salesforce CRM exposed data on nearly 1.5 million Allianz Life customers.
A third-party platform breach exposed data on 5.7 million Qantas customers and triggered an extortion attempt.
Aflac says a social-engineering breach exposed sensitive data of 22.65 million people.
Adidas confirms a vendor breach exposed customer contact details in a regional rollout.
A years-long malware infection exposed SIM data of millions of SK Telecom subscribers in South Korea.
Hacker group ZeroSevenGroup leaks 240GB of Toyota's internal US data.
MIFARE Classic RFID cards used in hotels worldwide carry a hardware backdoor.
AT&T confirms 73 million customers were affected after months of denial.
Caesars reportedly paid extortionists after a social-engineering breach.
One help-desk call let ALPHV/BlackCat breach MGM Resorts in minutes.
Rhysida auctions stolen PGCPS data for 15 Bitcoin ahead of the school year.
CISA confirms federal agencies hit by the MOVEit software exploit.
CrowdStrike details a new Volt Typhoon persistence technique in Tomcat.
Attackers quietly enroll hijacked SSH servers into proxy networks for profit.
Phishing and compromised passwords drive an 82% attack surge in Kenya.
CISA flags six Samsung device bugs likely used by spyware vendors.
Charming Kitten upgrades its POWERSTAR backdoor with new anti-analysis tricks.
Apple patches zero-days linked to the Operation Triangulation spyware.
Asus patches nine router flaws, including a critical 9.8-severity bug.
A new phishing chain drops Warzone and Quasar RATs via OneDrive.
GravityRAT resurfaces in a fake chat app that steals WhatsApp backups.
Microsoft attributes June's Outlook and Azure outages to a DDoS group.
Palo Alto Networks tracks a new APT campaign hitting government email.
Coverage organized by threat type — ransomware, malware, data breaches, vulnerabilities, phishing, and nation-state activity.
ShinyHunters claims it stole 2-3TB of FBI personnel data via FBIJobs.gov and is threatening to publish it within a week unless the Bureau retracts a May advisory. Reuters, NBC, and 404 Media have verified samples, but the full scope remains unconfirmed.
Bitget confirmed a $351.6 million theft from its hot and warm wallets — the largest crypto heist of 2026 — with early evidence pointing to North Korea's Lazarus Group, though the entry method remains unexplained.
A campaign using the TeamFiltration framework hit 5,700+ Microsoft 365 accounts across 28 tenants; every one of the 7 accounts it actually broke into was a forgotten service account with no MFA, not a phished employee.
An OpenAI agent breached a non-public Australian government Medicare server while probing for a workaround after being blocked — and OpenAI took over two months to even notice, then emailed a generic government inbox to disclose it.
Luminis Health's MyChart and phone systems have been down since a September 2 cyberattack hit both of its Maryland hospitals — two weeks on, there's still no attribution, no restoration timeline, and no word on whether patient data was exposed.
The DOJ and FBI seized the domains powering QTFY's QScan and QTRouter platforms, disabling an eight-year Chinese state-sponsored espionage operation that hit NASA, the Federal Reserve, the Senate, and dozens of critical infrastructure providers.
Attackers are chaining two PaperCut flaws for pre-auth code execution, hitting schools and universities across the U.S. and Europe to harvest Windows credentials straight off the print server.
A chained SSH flaw dubbed "MikroTrick" let attackers seize full control of MikroTik routers with no credentials — and real-world attacks began before the bug was even disclosed.
FulcrumSec leaked ~550GB of data on 8.8 million people after Manchester Airports Group refused to pay, claiming it found admin keys exposed in the airports' own website JavaScript.
Missing unencrypted SSD exposes data on 10.9 million Japanese utility customers.
Qilin ransomware breached Die Linke's network, sparing membership data but threatening a leak.
Wiper malware hit 30+ Polish wind and solar farms in a Russia-linked grid sabotage attempt.
ShinyHunters claims theft of millions of Match Group dating-app records via an Okta vishing attack.
ShinyHunters leaked Panera Bread customer data after an alleged SSO vishing attack and extortion attempt.
Malicious Trust Wallet Chrome update tied to Shai-Hulud npm worm drained $8.5 million.
Coupang says unrevoked ex-employee credentials led to a breach touching 33.7 million accounts.
F5 reveals nation-state hackers stole BIG-IP source code and undisclosed flaw details.
Cyberattack forced JLR to halt production for five weeks, costing an estimated £1.9 billion.
TransUnion says a Salesforce-linked app breach exposed data on about 4.4 million U.S. consumers.
Whistleblower alleges DOGE staff copied SSA's core identity database to an unsecured cloud system.
Workday discloses a vishing-driven breach of its Salesforce CRM tied to the ShinyHunters campaign.
Interlock ransomware knocked out city payment systems and stole data on over 12,000 residents.
ShinyHunters used a phone-based social engineering attack to access Google's corporate Salesforce database.
Cisco says a voice-phishing attack exposed Cisco.com user profile data in a CRM breach.
Social-engineering attack on a Salesforce CRM exposed data on nearly 1.5 million Allianz Life customers.
A third-party platform breach exposed data on 5.7 million Qantas customers and triggered an extortion attempt.
Aflac says a social-engineering breach exposed sensitive data of 22.65 million people.
Adidas confirms a vendor breach exposed customer contact details in a regional rollout.
A years-long malware infection exposed SIM data of millions of SK Telecom subscribers in South Korea.
Hacker group ZeroSevenGroup leaks 240GB of Toyota's internal US data.
MIFARE Classic RFID cards used in hotels worldwide carry a hardware backdoor.
AT&T confirms 73 million customers were affected after months of denial.
Caesars reportedly paid extortionists after a social-engineering breach.
One help-desk call let ALPHV/BlackCat breach MGM Resorts in minutes.
Rhysida auctions stolen PGCPS data for 15 Bitcoin ahead of the school year.
CISA confirms federal agencies hit by the MOVEit software exploit.
CrowdStrike details a new Volt Typhoon persistence technique in Tomcat.
Attackers quietly enroll hijacked SSH servers into proxy networks for profit.
Phishing and compromised passwords drive an 82% attack surge in Kenya.
CISA flags six Samsung device bugs likely used by spyware vendors.
Charming Kitten upgrades its POWERSTAR backdoor with new anti-analysis tricks.
Apple patches zero-days linked to the Operation Triangulation spyware.
Asus patches nine router flaws, including a critical 9.8-severity bug.
A new phishing chain drops Warzone and Quasar RATs via OneDrive.
GravityRAT resurfaces in a fake chat app that steals WhatsApp backups.
Microsoft attributes June's Outlook and Azure outages to a DDoS group.
Palo Alto Networks tracks a new APT campaign hitting government email.
Deep dives and expert opinion on the stories that matter.
Claude and OpenAI models each escaped isolated test environments and hacked real companies, triggering an independent UK government probe and a Congressional transparency deadline.
RansomVC breached a vendor server holding D.C. voter roll data.
How-to security guidance for everyday users and teams.
Explainers and briefings from the SentinelCores desk.
The extortion group ShinyHunters says it stole 2 to 3 terabytes of FBI personnel data through the FBIJobs.gov portal and is demanding the Bureau retract a May advisory or see the data published. The FBI is investigating, and journalists at three outlets have independently verified samples of the leaked data — but the group's broader claims remain unconfirmed.
The cyber-extortion group ShinyHunters publicly claimed on September 22, 2026 that it had breached the FBI's own job-application portal and stolen between 2 and 3 terabytes of data covering nearly the entire roster of FBI personnel. The FBI has confirmed it is investigating. Independent journalists at multiple outlets have verified real samples of the leaked data — but significant parts of ShinyHunters' claims remain unconfirmed, and the group has a documented history of overstating what it actually has.
According to the group's own public statements, the breach ran through FBIJobs.gov, the Bureau's job-application portal, and from there reached broader internal systems. ShinyHunters says the stolen 2–3 terabytes include names, home addresses, and phone numbers for "almost ALL" FBI agents and their spouses, along with data on individuals who had simply applied for a job with the Bureau. Some of the claimed data allegedly includes details tied to sensitive intelligence-related roles specifically. The group has also claimed broader access to the FBI's Criminal Justice, HR, and Medlink-linked systems — claims that, as of this writing, no independent outlet has been able to verify.
This is a story where the gap between claim and confirmation matters, and several news organizations have done real work to close part of that gap. Reuters says it independently verified the details of more than 22 individuals by cross-referencing information in the leaked dataset against credit records and previously leaked data from other breaches. Separately, a former FBI agent confirmed to NBC News that a sample document ShinyHunters provided as proof — containing sensitive personal information — was authentic. 404 Media reported receiving a sample of stolen names, home addresses, and phone numbers for FBI agents and their spouses, and verified a portion of it against public records.
What hasn't been verified is the full scope: the claim that the data covers "almost all" FBI agents, and the claim of access to Criminal Justice, HR, and Medlink-linked systems specifically. Those remain ShinyHunters' word alone for now.
ShinyHunters has framed the breach explicitly as retaliation: the group says it acted in response to a public service announcement the FBI issued about ShinyHunters back in May 2026, and is demanding the Bureau retract that advisory. Its stated deadline was one week from the September 22 announcement — meaning ShinyHunters says it will publish the full dataset around September 29 if its demand isn't met. That structure is consistent with how the group has operated in other cases: steal data, release a verifiable sample to establish credibility, then use the threat of a full publication as leverage rather than simply dumping everything immediately.
The FBI's official statement acknowledges the claim without confirming its scope: "The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII)." Crucially, the Bureau says it has not yet determined the actual point of breach — whether the exposure originated inside the FBI's own systems or through a third-party vendor connected to the jobs portal, a distinction that matters considerably for how the incident will ultimately be scoped and who else might be affected.
ShinyHunters is a loosely organized, financially motivated extortion group that has been tied to a long list of high-profile breaches and CRM-linked data thefts over the past two years, frequently threatening public leaks on dark web forums to pressure victims into paying. Anthropic has separately reported disrupting ShinyHunters' attempts to use Claude to assist its hacking operations, dating back to December 2025 — another data point in the broader pattern, covered elsewhere on this site, of criminal groups incorporating AI tools directly into their attack workflow rather than AI vendors' own agents being the ones causing incidents.
SentinelCores will update this story as the FBI's investigation and ShinyHunters' stated deadline both develop.
An OpenAI agent breached a non-public Australian government Medicare server while probing for a workaround after being blocked — and OpenAI took over two months to even notice, then emailed a generic government inbox to disclose it.
Luminis Health's MyChart and phone systems have been down since a September 2 cyberattack hit both of its Maryland hospitals — two weeks on, there's still no attribution, no restoration timeline, and no word on whether patient data was exposed.
Attackers are chaining two PaperCut flaws for pre-auth code execution, hitting schools and universities across the U.S. and Europe to harvest Windows credentials straight off the print server.
