Extortion & Blackmail

ShinyHunters extorted Jeppesen ForeFlight, the aviation-navigation unit Boeing sold to Thoma Bravo for $10.55B. Boeing acknowledged the threat-actor claims, the company reported no operational impact, and a suspected member was reportedly detained in Jordan and cooperating with the FBI.

Core infrastructure engineer Daniel Rhyne got 32 months for planting scheduled tasks on his employer's domain controller that deleted 13 domain admins and reset passwords across 254 servers and 3,284 workstations, then demanding 20 bitcoin. A reused password and a rogue VM gave him away.

Operation KillSwitch seized KillSec's leak site and five servers on 30 September 2026, securing 110 TB of stolen data. A 16-year-old is the alleged main operator; a Dutch national is indicted in Puerto Rico. What the primary sources say, and where the numbers diverge.

GTIG tracked UNC6240 (linked to ShinyHunters) mass-exploiting PeopleSoft's CVE-2026-35273 (CVSS 9.8 unauth RCE). Defenders who blocked /PSEMHUB at a WAF instead of patching were bypassed: the actor requested /%50SEMHUB/, one URL-encoded character, then dropped web shells and the SIDEEYE backdoor.

Dutch police arrested a 24-year-old Amsterdam man on Sept 15, 2026 in the ShinyHunters investigation; a Rotterdam court remanded him 90 days, and the FBI called him an 'alleged leader.' A separate inquiry into two planned murders abroad is, police say, not part of the ShinyHunters case.

A U.S. court sentenced Cameron Wagenius, 22, a former Army soldier known as 'kiberphant0m,' to 70 months for a 2023-24 campaign extorting at least 10 telecom and tech firms. DOJ says he posted officials' stolen call records with a ransom threat and sought to sell data to foreign intelligence.

ShinyHunters claims it breached the FBI, defaced FBIjobs.gov, and stole ~2TB on almost all agents via a PeopleSoft zero-day. The defacement is observed and 404 Media matched a data sample to public records — but the FBI says the breach point is undetermined and most is unverified.

ShinyHunters defaced the Clop ransomware gang's Tor leak site with its Umbreon logo and claims it stole the source code, /var/log, and Clop's onion private keys — retaliation over the 2025 Oracle EBS exploit dispute. Only the defacement is independently confirmed; the theft claims are not.

A Conti affiliate who coded a loader and intruded on twelve victims got 48 months in Nashville on 10 September 2026. The judgment credits custody since his July 2023 arrest in Cork, leaving about ten months. Plea agreement and docket analysed.

FulcrumSec took 8.8 million passengers' records from Manchester, Stansted and East Midlands airports through a marketing-platform API key sitting in the websites' public JS. Archived copies show the same key had been there since at least January 2023. MAG refused the ransom; 550 GB was published.

Cl0p exploited an unauthenticated deserialization flaw in PTC Windchill as a zero-day in June 2026, deployed a purpose-built web shell that decrypts the application's keystore, and named 43 manufacturers, including Shell, Philips and GE. It was the second such flaw in three months.

ShinyHunters says it vished McKesson employees, took over Okta sessions, and pulled a terabyte from Salesforce and Snowflake between 20 and 25 August 2026. McKesson has confirmed exfiltration of patient data and nothing about how.

Three men who worked in incident response ran BlackCat attacks. One of them was simultaneously negotiating on behalf of ransomware victims — and passing the attackers his own clients' insurance limits.

An analysis of the serial cyber intrusions targeting Rockstar Games from 2022 to 2026, spanning Lapsus$ source code theft to the CyberLeek Solana memecoin extortion campaign.

A financially motivated threat actor (UNC5537) compromised Snowflake customer instances across 165+ organizations by credential stuffing against accounts lacking MFA, exfiltrating terabytes of sensitive data, and conducting mass extortion — the largest cloud data warehouse compromise to date.