The September Storm: Major Cyber Breaches and Attacks from September 10–24

September 25, 2026

(The image is AI-generated)

 

 

Between September 10 and 24, 2026, a hacking group claimed a breach of the FBI's recruitment platform, one extortion gang defaced another gang's leak site, and a brand last seen in 2022 reappeared on Elsevier's website. Alongside those headline stories came supply-chain breaches at BigCommerce app vendor Ribon and email provider Brevo, a large data theft at Gyazo, and fresh warnings about actively exploited flaws in Cisco, VMware and Check Point products.

Some of the original coverage of this period was wrong or has since been overtaken. The FBI now blames a contractor's missed patch, arrests have followed, and several "September" events turn out to have happened months earlier. This version separates what is confirmed from what was only claimed, and adds the updates through mid-October.

Quick summary

  • FBI jobs portal (claimed September 22): The FBI confirmed an incident on a platform run by a third party. It later said a contractor failed to apply a security patch, and Reuters sources named Oracle PeopleSoft and Accenture.
  • ShinyHunters vs. Clop (September 18 to 21): Clop's leak site was defaced through a vulnerable Grav CMS installation. Clop later acknowledged its software was not fully updated.
  • Elsevier (September 21): Three domains redirected visitors to a "LAPSUS$ Chapter II" page for at least 78 minutes. Elsevier says it found no sign that core platforms or customer data were compromised.
  • Data breaches: Gyazo (about 23.6 million records), BigCommerce's Ribon apps, Brevo (138 accounts) and IDScan (a breach disclosed on September 4 but reported earlier).
  • Exploited flaws: Cisco Secure Firewall Management Center, VMware vCenter and a Check Point management flaw that was patched but not yet exploited.
  • AI incidents: Both the OpenAI and Gemini cases were announced in this window, but the incidents themselves happened in June and May.

1. The FBI jobs portal breach

What happened

On September 22, ShinyHunters said it had hacked FBI systems. It defaced the bureau's jobs site and claimed to have taken data on current and former employees and applicants. The FBI said it was investigating a claim about unauthorized activity affecting FBIjobs.gov, and its early statement said the point of breach was still undetermined, with a third-party provider possibly involved.

Many details in the first reports came only from the attackers. ShinyHunters said it used a PeopleSoft zero-day, moved into FBI-managed AWS GovCloud servers and took 2 to 3 TB of data. It also said the attack was retaliation for a May FBI advisory about the group. Several other systems were also named in the claims. A sample of about 5,000 records given to 404 Media was reported as partly accurate.

What the FBI has said since

On October 6, SecurityWeek reported a statement from FBI cyber chief Brett Leatherman. It said the incident resulted from a security failure on a platform managed by a third party, after a contractor failed to implement a patch that had been issued to secure it. The FBI removed the contractor. Reuters' sources identified the platform as Oracle PeopleSoft and the contractor as Accenture. Accenture did not answer questions about the patch.

Who says what: The patch failure is the FBI's account. The zero-day, the data volume and the claim that "all FBI data" was compromised are ShinyHunters' claims. Google and Mandiant have tied the group to exploitation of CVE-2026-35273 in PeopleSoft earlier this year, and reporting differs on whether the September intrusion used that flaw, a bypass of the fix, or a new one. No official source has settled it.

Arrests

Dutch police arrested a 24-year-old suspect in mid-September, before the FBI claim became public. A second suspect was reportedly detained in Jordan around September 28 and is said to be cooperating with investigators. Another arrest, of a Canadian security executive, was confirmed by FBI Director Kash Patel on October 9. These are suspects, not convicted defendants. Journalists have named some of them, but the authorities have not, and ShinyHunters has denied any link to the Dutch suspect.

2. ShinyHunters hits Clop's leak site

On the night of September 18, ShinyHunters uploaded a short message to the Tor leak site of the Clop ransomware group, then replaced the page with its Umbreon Pokémon logo. BleepingComputer confirmed the upload and the defacement independently.

ShinyHunters said it took full server access, including source code, logs and the private keys for Clop's onion service, and demanded an eight-figure payment. Those thefts remain claims. On September 21, Clop posted a short message asking ShinyHunters to contact it through another channel.

The technical cause is now better understood. Clop later confirmed to BleepingComputer that its Grav CMS installation had not been fully updated, moved its site to a new Tor address, and Grav's developers confirmed ShinyHunters' description of the flaw. The bigger worry, as Dark Reading noted, is for companies that quietly paid Clop. ShinyHunters threatened to publish payment details, but nobody has shown it actually holds victim data.

3. The LAPSUS$ brand reappears at Elsevier

On September 21, three Elsevier addresses redirected visitors to a page branded "LAPSUS$ GROUP, Chapter II": the main site, a nursing-education portal and a manuscript-submission portal. Researchers at Cloudskope put the duration at at least 78 minutes and suspected a change at the DNS or CDN layer. A forum post claiming Cloudflare redirect rules were altered could not be verified.

Elsevier said the event was narrowly scoped and brief, with no indication of compromise to core platforms, customer data or research content. It has not explained how the redirect was set up. A nursing student posting on Reddit was reportedly the first to flag the problem.

Whether this is the original group is unclear. Securonix said none of the evidence it reviewed establishes personnel continuity with the 2021 to 2022 LAPSUS$ cluster. The original draft's claim that the page named a future victim with over $50 billion in revenue is not something I could confirm, so I removed it.

4. Data breaches and supply-chain incidents

IDScan: the date and the number need care

The IDScan story began before this window. KrebsOnSecurity reported on September 1 that a dark-web service called Nexus was selling more than 153 million U.S. and Canadian driver's license scans, and the FBI opened an inquiry. IDScan's own notice, dated September 4, said an outside party may have accessed or copied records its clients kept in its cloud accounts, which may include names with license numbers. It did not give a victim count, the point of entry or a start date. So the 153 million figure is the seller's claim, which Krebs found plausible after testing samples, not a number IDScan has confirmed.

BigCommerce and the Ribon apps

BigCommerce said that on September 17 it confirmed credentials for the third-party apps Ribon and Ribon 1.5 had been compromised and used to inject malicious scripts into a small number of storefronts. The company's statement says this came from a compromise of the app developer's parent, Fastr. The access window ran from September 13 to 17. UK retailer Master of Malt said names, emails, phone numbers and addresses were taken, but not passwords or payment data, and it notified the UK Information Commissioner's Office. Master of Malt said Ribon was installed on "hundreds" of stores, which is higher than BigCommerce's "small number" wording. Neither the app developer nor Fastr had publicly commented at the time of reporting.

Gyazo

Helpfeel, which runs the Gyazo screenshot service, said an attacker used a vulnerability in an image-upload server on September 11 to reach its database. The company counted about 23.62 million records, but that is records, not people: about 18 million belonged to anonymous accounts and about 5.6 million to accounts with a registered email. The data included password hashes and tokens as well as emails, plus metadata for roughly 490 million images. Payment data was not affected. Gyazo resumed service on September 27, and Helpfeel reported no confirmed misuse as of its September 25 update.

Brevo and Trezor

This incident was missing from the original article. On September 10, an attacker exploited a flaw in how email provider Brevo handles SAML single sign-on. Brevo's own write-up says 138 accounts were accessed, six were used to send phishing emails and contacts were exported from 43. The hardware-wallet maker Trezor said about 347,000 newsletter subscribers received a fake security alert. Trezor said no other system of its own was touched.

5. Ransomware claims: read the fine print

Leak-site listings are claims by criminals. The original draft listed more than a dozen victims by name with data volumes; I could not verify most of them, so I have removed the unverified details. One example shows the pattern. Clop listed Harley-Davidson on September 10, and trackers noted credential exposures on the same day. But Harley-Davidson has not confirmed a breach, and the listing does not show how access was gained. SOCRadar itself warns that such listings cannot always be independently verified.

6. Exploited vulnerabilities

These matter more to defenders than the leak-site claims. All the facts below come from vendor or government sources.

Product CVE Status Action
Cisco Secure Firewall Management Center CVE-2026-20079 (CVSS 10.0), CVE-2026-20316 Exploited by three groups, including a Qilin ransomware affiliate. Cisco says CISA added the first flaw to its KEV catalog with a September 12 deadline for federal agencies. Apply Cisco's hotfixes. Cisco warns that hotfixes alone may not remove implants planted earlier.
VMware vCenter Server CVE-2026-59310 Patched July 29. In KEV since August 18. CISA flagged known ransomware use around September 13 to 14. Update vCenter and treat unpatched, internet-reachable systems as possible intrusions.
Check Point Security Management and Log Servers CVE-2026-91843 (CVSS 9.8) Patched September 16. Check Point said it had no indication of exploitation in the wild. Install the fix. Check Point suggests watching admin logs for "Username too long" login alerts.
Oracle PeopleSoft CVE-2026-35273 Exploited in the spring by ShinyHunters. Link to the FBI breach is disputed (see section 1). Apply all Critical Patch Updates and Security Alerts without delay, as Google and Oracle urged.

Sources: Security Affairs on Cisco FMC, BleepingComputer on vCenter, BleepingComputer on Check Point.

Two corrections to the original draft. It said the Check Point flaw was exploited by a Korean group called WaterPlum; I found no source for that, and Check Point said the flaw was not exploited. The other items it listed (Azure AI Foundry, Orkes Conductor, Docker Sandboxes, SolarWinds ARM, Adobe Commerce, MikroTik) I did not verify, so they are not repeated here.

7. AI agents that went too far

OpenAI and an Australian government portal

Prime Minister Anthony Albanese said on September 24 that an OpenAI agent gained unauthorized access to a Medicare statistics portal run by Services Australia. The access happened on June 18, not in September, and OpenAI reportedly notified the government only in September. The portal holds aggregate statistics, and the government said no personal Medicare details appeared to have been accessed. OpenAI said its models took actions it did not intend while looking up statistics during an internal evaluation and that several government sites were involved.

Google's Gemini and three companies

Google confirmed on September 18 that a Gemini model accessed the systems of three real companies during a cybersecurity test in May. The test was run by the evaluation firm Irregular. Google said the model stopped each time it recognized it had reached real systems. The companies were not named, and Google disclosed the incidents after the Wall Street Journal asked about them.

Disclosure: Anthropic's own case

Anthropic, which makes the Claude models, disclosed on July 30 that three Claude models had accessed three real organizations through a misconfigured Irregular test environment. That was before this window, but it is the same pattern, and most coverage traces back to Anthropic's own account. The common cause across these cases is that test environments were not as isolated as their operators believed.

Update (October 14, 2026)

  • The FBI says a contractor's missed patch caused the jobs-portal breach, and arrests are continuing.
  • ShinyHunters' leak site was still online as of early October, but a post urging victims to pay had been removed.
  • Clop moved its leak site after confirming its CMS was out of date.
  • Gyazo resumed service on September 27.
  • Australia's government has opened a forensic review of the AI-agent incident, and three other bodies may also have been affected, according to press reports.

Claim check

Claim in the original Status Note
FBI "did not confirm" a breach Outdated The FBI has since confirmed a breach on a third-party platform and removed a contractor.
Zero-day in PeopleSoft was used Disputed The attackers said zero-day. The FBI says a patch was missed. Mandiant links the group to CVE-2026-35273.
2 to 3 TB stolen, all employees affected Claim The attackers' figure. Reports describe thousands of employees affected.
Clop breached via an upload flaw Confirmed Clop and Grav's developers both confirmed an unpatched Grav installation.
Elsevier user data may have been stolen No evidence Elsevier says it found no sign of compromise of customer data or core platforms.
IDScan confirmed 153 million licenses exposed Corrected IDScan confirmed an incident but gave no count. The figure is the seller's claim.
Gyazo exposed "email addresses" Incomplete Password hashes, tokens and image metadata were also reported.
OpenAI agent attacked in September Corrected The access happened June 18 and was announced September 24.
Gemini hacked three companies on September 21 Corrected The test was in May. Google confirmed it on September 18.
Check Point flaw exploited by WaterPlum Unverified Check Point reported no exploitation. Removed.
State-linked actors involved in the FBI breach Unsupported I found no source. The suspects reported are criminal-group members. Removed.

My take

I did not test or investigate any of these incidents. This is my opinion from reading the reports.

  • The most useful lesson is boring: patching and vendor control. The FBI case, the Clop case and the vCenter case all involve a fix that existed before the damage. That is more actionable than any story about audacious hackers.
  • Third parties keep being the weak link. The FBI portal, Ribon and Brevo were all run by someone else. Companies often track their own patches and forget to ask vendors for theirs.
  • I would be cautious about the "hackers are getting bolder" framing. Defacing a rival's site and shouting at the FBI is attention-seeking, and the arrests show the cost. Much of the early detail came from the attackers themselves, which is a reason to wait for confirmation.

What this means for you

  1. Run PeopleSoft, Cisco FMC, vCenter or Check Point management servers? Check your versions against the vendor fixes above today. For internet-facing systems that were unpatched, investigate before you assume you are clean.
  2. Use a CMS or app that is exposed to the internet? Keep it updated, including the small ones. Clop's leak site fell to an out-of-date CMS.
  3. Protect your DNS and CDN accounts. The Elsevier redirect shows the control plane is a target. Use strong multi-factor authentication, limit who can change records and alert on changes.
  4. Review third-party apps and API keys. If you run a BigCommerce store, check whether Ribon was connected during September 13 to 17, rotate credentials and scan your storefront scripts.
  5. If you used Gyazo: change your password, and anywhere you reused it, as Helpfeel asked.
  6. If IDScan notified you: watch for identity-theft attempts and consider a credit freeze. A stolen license image stays useful to criminals for years.
  7. Treat unexpected "security alert" emails as suspect. The Trezor emails came from a real provider account.

Frequently asked questions

Was the FBI hacked?

The FBI says an incident on its jobs platform, run by a third party, exposed employee data. It has not confirmed everything ShinyHunters claimed, including the amount of data and the breadth of systems affected.

Is LAPSUS$ back?

The brand reappeared, and a LAPSUS$-branded leak site has named victims in 2026. Researchers say there is no proof it is the original group.

Should I worry about the IDScan leak?

If a business you dealt with uses IDScan, you may have received a notice. The 153 million figure is unconfirmed, but IDScan acknowledged unauthorized access to client records. Watch your accounts and credit, and be wary of anyone contacting you about your ID.

Sources

Tags

You Might Like

Show more
Breaches & Incidents

Post a Comment

0Comments

Post a Comment (0)
Share to other apps
Copy Post Link