Reported by 15 outlets

Timeline

1. original reporting

   ShinyHunters claims it breached FBI systems via an alleged unpatched PeopleSoft RCE, then moved laterally into AWS GovCloud. The group alleg

   cyberworldops.eu · 21d ago · September 22nd, 2026

   ShinyHunters claims it breached FBI systems via an alleged unpatched PeopleSoft RCE, then moved laterally into AWS GovCloud. The group alleg

   via Mastodon https://cyberworldops.eu/en/shinyhunters-alleges-fbi-breach-through-an-unknown-peoplesoft-rce-flaw

2. update from bleepingcomputer.com

   ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

   bleepingcomputer.com · 24d ago · September 19th, 2026

   The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. The attack began Friday night when ShinyHunters exploited what they claim is an unauthenticated file upload vulnerability in Grav CMS, which they used to upload a small text file to Clop's site. File downloaded from Clop's data leak site Source: BleepingComputer The small text file contained a message from the threat actors to the Clop ransomware gang, warning not to threaten them and including a link to ShinyHunter's own data leak site. "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time," read the uploaded file. Several hours later, ShinyHunters told BleepingComputer that they had "completely defaced" the Clop site. Visiting the site confirmed it had been replaced with a page displaying ASCII art of Umbreon, the Pokémon used as ShinyHunters' logo. The defacement also included a link to the group's Tor site and the message, "rooting your systems since '19 ;)".

3. mentioned by malware.news

   ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

   malware.news · 24d ago · September 19th, 2026

4. mentioned by cyberworldops.eu

   ShinyHunters compromised Clop's Tor leak site, defaced it and claimed theft of server data and onion private keys. BleepingComputer confirme

   cyberworldops.eu · 24d ago · September 19th, 2026

5. update from hackread.com

   ShinyHunters hacked and defaced Clop's ransomware leak site, replacing its content with ShinyHunters branding as its own onion site goes off

   hackread.com · 24d ago · September 19th, 2026

   ShinyHunters hacked and defaced Clop's ransomware leak site, replacing its content with ShinyHunters branding as its own onion site goes off

   via Mastodon https://hackread.com/shinyhunters-hacks-defaces-clop-ransomware-leak-site/

6. update from tugatech.com.pt

   ShinyHunters attacks ransomware Clop's leak site and threatens to extort rival gang

   tugatech.com.pt · 24d ago · September 19th, 2026

   ShinyHunters attacks ransomware Clop's leak site and threatens to extort rival gang

   via Mastodon https://tugatech.com.pt/t91374-shinyhunters-ataca-site-do-ransomware-clop-e-ameaca-extorquir-grupo-rival

   ---

   The ShinyHunters extortion group infiltrated and defaced the Clop (also known as Cl0p) ransomware group's data leak site on the Tor network. Hours later, the main page was fully replaced by ASCII art of an Umbreon (the logo adopted by ShinyHunters), accompanied by a message stating they had been accessing systems since 2019. ## Tor key theft and ultimatum

   Beyond the visual defacement, the attackers claim to have obtained full access to the server. Among the stolen information is reportedly the source code, Grav CMS plugins, and system logs stored in "/var/log", which could expose the IP addresses of anyone who connected to the infrastructure. If the claim is true, this would allow the attackers to host an identical site with the same onion address, taking control of the original portal. The objective of the action is now to extort the rival gang, with a 72-hour deadline imposed for Clop to make contact. ## Revenge for death threats and exploits

   The motivation for the attack stems from a dispute over Clop's 2025 Oracle E-Business Suite data theft campaign. At the time, ShinyHunters accused Clop of using a vulnerability (CVE-2025-61882) in Oracle's platform whose exploit belonged to them and had allegedly been obtained without authorization. The tension escalated when, after the incident, a Clop representative allegedly contacted a ShinyHunters member directly. According to the group now responsible for the attack, the Clop representative sent explicit death threats and promised to expose the identities of ShinyHunters members, triggering this direct retaliation against the rival group's infrastructure.

7. update from dev.to

   ShinyHunters Hacks Clop Leak Site: Claims an Unauthenticated File Upload Led to Tor Private Key Theft # security # threatintel # software #

   dev.to · 24d ago · September 19th, 2026

   ShinyHunters Hacks Clop Leak Site: Claims an Unauthenticated File Upload Led to Tor Private Key Theft # security # threatintel # software #

   via Mastodon https://dev.to/anoymask/shinyhunters-hacks-clop-leak-site-claims-an-unauthenticated-file-upload-led-to-tor-private-key-1bl0

8. mentioned by www.bleepingcomputer.com

   🤖 ShinyHunters breached Cl0p ransomware's data-leak site, defacing the Tor page and allegedly stealing server data plus the onion service pr

   www.bleepingcomputer.com · 24d ago · September 19th, 2026

9. update from beyondmachines.net

   ShinyHunters Breaches Clop Ransomware Leak Site in Retaliatory Cyberattack ShinyHunters breached and defaced the Clop ransomware gang's leak

   beyondmachines.net · 23d ago · September 20th, 2026

   ShinyHunters Breaches Clop Ransomware Leak Site in Retaliatory Cyberattack ShinyHunters breached and defaced the Clop ransomware gang's leak

   via Mastodon https://beyondmachines.net/event_details/shinyhunters-breaches-clop-ransomware-leak-site-in-retaliatory-cyberattack-5-m-2-7-h/gD2P6Ple2L

10. mentioned by www.bleepingcomputer.com

    🤖 ShinyHunters breached Clop's data-leak site, defacing the Tor page and allegedly stealing server data plus the private keys of its onion s

    www.bleepingcomputer.com · 23d ago · September 20th, 2026

11. update from dev.to

    ShinyHunters Rooted Clop's Leak Site Through Grav CMS, and Now Wants to Extort the Extortionists # cybersecurity # infosec # security # soft

    dev.to · 23d ago · September 20th, 2026

    ShinyHunters Rooted Clop's Leak Site Through Grav CMS, and Now Wants to Extort the Extortionists # cybersecurity # infosec # security # soft

    via Mastodon https://dev.to/etairos/shinyhunters-rooted-clops-leak-site-through-grav-cms-and-now-wants-to-extort-the-extortionists-1gl0

12. mentioned by www.bleepingcomputer.com

    # ShinyHunters hacks # Clop leak site, threatens to extort # ransomware gang https://www. bleepingcomputer.com/news/secu rity/shinyhunters-h

    www.bleepingcomputer.com · 23d ago · September 20th, 2026

13. update from malware.news

    ShinyHunters hacks rival extortion gang and takes over its dark web site

    malware.news · 22d ago · September 21st, 2026

    ShinyHunters is a financially motivated cybercrime and extortion group active since 2019. It is known for stealing large volumes of data and pressuring victims to pay, rather than necessarily deploying ransomware. One recent high-profile organization targeted by the group was Instructure, the maker of Canvas LMS. ShinyHunters claimed it stole 3.65 TB of data belonging to about 9,000 academic institutions . Clop, also written Cl0p, is a ransomware and data-extortion operation associated with large-scale exploitation of vulnerabilities in enterprise software and file-transfer platforms. In its recent campaign targeting PTC Windchill systems, it named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, and Toast. At the time of writing, the Clop dark web leak site looks like this: Domain seized by ShinyHunters The rest of that page looks much the same as the ShinyHunters leak site, which includes this “Note to Cl0p”: “Note to Cl0p_- 21 Sep UPDATE: Every 24 hours you fail to engage with us the demands increase. The demand now includes a ma

14. update from insicurezzadigitale.com

    ShinyHunters breaches Clop leak site and threatens to extort the extortionists

    insicurezzadigitale.com · 22d ago · September 21st, 2026

    Open war in the ransomware underground: ShinyHunters exploits the same technique that made ransomware groups famous. via Mastodon https://insicurezzadigitale.com/shinyhunters-buca-il-leak-site-di-clop-e-minaccia-di-estorcere-gli-estorsori/

15. mentioned by www.infosecurity-magazine.com

    he ShinyHunters hacking and extortion gang has claimed a cyber-attack against a fellow cybercriminal outfit, the Clop ransomware group. 👀 ht

    www.infosecurity-magazine.com · 22d ago · September 21st, 2026

16. update from osintsights.com

    Rivals Hijack Clop's Leak Site, Demand Eight-Figure Payout A rival hacking crew, ShinyHunters, has hijacked Clop's dark-web leak site, posti

    osintsights.com · 22d ago · September 21st, 2026

    Rivals Hijack Clop's Leak Site, Demand Eight-Figure Payout A rival hacking crew, ShinyHunters, has hijacked Clop's dark-web leak site, posti

    via Mastodon https://osintsights.com/rivals-hijack-clops-leak-site-demand-eight-figure-payout?utm_source=mastodon&utm_medium=social

17. mentioned by osintsights.com

    ShinyHunters Disrupts Clop Ransomware Gang's Operations In a bold move, ShinyHunters infiltrated and defaced Clop's dark web leak site, clai

    osintsights.com · 22d ago · September 21st, 2026

18. update from insicurezzadigitale.com

    ShinyHunters hacks Clop leak site and threatens to extort the extortionists

    insicurezzadigitale.com · 22d ago · September 21st, 2026

    Not by an international task force, not by a security vendor, but by another extortion gang: ShinyHunters. Now ShinyHunters is threatening to publish the stolen data if Clop does not pay within 72 hours. The two groups have history. According to ShinyHunters' account, the exploit behind Clop's October 2025 Oracle E-Business Suite campaign (CVE-2025-61882) was originally developed by ShinyHunters or the broader Scattered Lapsus$ Hunters collective, then obtained by Clop without authorization and used for large-scale extortion. The situation escalated: a Clop representative allegedly threatened ShinyHunters in Russian, with physical threats, motivating Saturday's attack. Technically, the intrusion was straightforward. Possession of those keys would theoretically allow running Clop's existing .onion address on servers controlled by ShinyHunters. ShinyHunters has openly declared its intent: "Going to extort them" -- applying the same business model against Clop that the group normally uses against corporate victims. For defenders, the episode offers several takeaways. Even the most established criminal infrastructure can have trivial attack surfaces -- in this case a CMS with a known upload vulnerability. If Clop's Tor service keys are truly compromised, organizations previously victimized by Clop should consider "double exposure" risk if ShinyHunters decides to release data that Clop had stolen but never published. Internal frictions between extortion groups can generate valuable intelligence -- logs, credentials, internal chats -- that researchers and law enforcement can exploit, as has happened with leaked chats from other ransomware gangs.

19. update from www.reuters.com

    Encore. Reuters: Cybercrime feud erupts on dark web as notorious group claims hijack of rival's website https://www. reuters.com/legal/gover

    www.reuters.com · 22d ago · September 21st, 2026

    Encore. Reuters: Cybercrime feud erupts on dark web as notorious group claims hijack of rival's website https://www.

20. mentioned by meterpreter.org

    The ShinyHunters Clop hack defaced the ransomware gang's Tor leak site via a Grav CMS flaw, with claims of stolen onion keys and a 72-hour e

    meterpreter.org · 22d ago · September 21st, 2026

21. update from malware.news

    Clop Hack: ShinyHunters Hijacks Data Leak Site

    malware.news · 22d ago · September 21st, 2026

    The Clop hack began on September 18, 2026, and quickly escalated from a small defacement into a public extortion attempt. The group initially demonstrated its access by uploading a small text file containing a taunting message.

22. update from therecord.media

    Reward: You've received the Popcorn Pauldrons of Spectating — +12 to watching criminals extort criminals, -0 to your actual ransomware expos

    therecord.media · 22d ago · September 21st, 2026

    Reward: You've received the Popcorn Pauldrons of Spectating — +12 to watching criminals extort criminals, -0 to your actual ransomware expos

    via Mastodon https://therecord.media/shinyhunters-clop-cyberattack-website

23. update from bleepingcomputer.com

    ShinyHunters hacks and defaces Cl0p - Will this shift the ransomware environment?

    bleepingcomputer.com · 22d ago · September 21st, 2026

    After the initial defacement ShinyHunters has posted a number of messages for Cl0p to negotiate and pay them a sum of 8 figures. It has been interesting watching this all develop. In March of 2025 I also watched as the news that Dragonforce defaced the leak site of Mamona(Prev Blacklock) came out and everything saying it was also tied to a feud with Blacklock code being an almost exact match for Dragonforce. Which has me curious, as even though this is not the first time we have seen this style of defacement, it is still very uncommon.

24. mentioned by hackread.com

    Clop has resurfaced on its own onion site with a message for ShinyHunters after the group hijacked its leak site and demanded an eight-figur

    hackread.com · 22d ago · September 21st, 2026

25. mentioned by databreaches.net

    NEW by me: ShinyHunters escalates dispute with FBI; claims to have seized job applicants' site and acquired data First, they threatened Clop

    databreaches.net · 21d ago · September 22nd, 2026

26. update from malware.news

    ShinyHunters escalates dispute with FBI; claims to have seized job applicants’ site and acquired data

    malware.news · 21d ago · September 22nd, 2026

    Joseph Cox reports: A high profile hacking group claims it has breached multiple FBI-related services and stolen data “on all FBI employees and applicants.” A representative of the group, called ShinyHunters, told 404 Media the data includes FBI agents’ names, home addresses, phone number, and information on their spouse.

27. update from bleepingcomputer.com

    ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach

    bleepingcomputer.com · 21d ago · September 22nd, 2026

    ShinyHunters claims it stole between 2TB and 3TB of data from the agency, including information on current and former FBI employees, job applicants, and other internal records. ShinyHunters further claims it is now exploiting the same alleged zero-day against other organizations, including Fortune 500 companies. BleepingComputer has not independently verified the alleged zero-day, lateral movement, or amount of stolen data. However, ShinyHunters shared a screenshot with BleepingComputer showing the FBI Jobs website at apply.fbijobs.gov defaced with the group's Umbreon Pokémon logo and a message claiming that FBI employee and applicant information had been compromised.

28. mentioned by www.bleepingcomputer.com

    🤖 ShinyHunters claims it breached FBI systems via an Oracle PeopleSoft zero-day, reaching internal services and stealing data on employees a

    www.bleepingcomputer.com · 21d ago · September 22nd, 2026

29. mentioned by bleepingcomputer.com

    ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach

    bleepingcomputer.com · 20d ago · September 23rd, 2026

30. update from malware.news

    ShinyHunters claims FBI breach was revenge for “false” report

    malware.news · 20d ago · September 23rd, 2026

    In a very long post on its leak site, the group outlines its grievances: “ PSA – READ THIS NOW Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended. We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to “disrupt” our operations, an effort that ultimately proved unsuccessful. For us to properly address and correct these unfounded allegations, we were compelled to adopt a forceful and assertive posture to ensure our response was fully acknowledged. This PSA today does just that.