ShinyHunters Claims Breaches of FBI and Clop Ransomware Leak Site

ShinyHunters, a well-known hacking group, began by targeting the Clop ransomware gang. Using an unauthenticated file upload vulnerability in the Grav CMS running Clop's Tor leak site, they gained access to sensitive files. This allowed them to steal internal data and the private keys used for the site's onion service.

The breach was quickly made public when ShinyHunters defaced Clop's site, taunting the rival gang and posting their own logo. This unusual move, where one criminal group attacked another, drew immediate attention from cybersecurity watchers.

On September 19, 2026, reports emerged that ShinyHunters had successfully compromised the Clop ransomware gang's leak site. The group exploited a file upload flaw, stole source code and private onion service keys, and publicly mocked Clop by defacing their site.

Shortly after, ShinyHunters escalated its campaign by announcing it had breached the FBI. On September 22, the group claimed to have stolen over 2 TB of data, including details about FBI employees and job applicants. They stated the breach was not financially motivated but a response to how the FBI described them in official reports.

ShinyHunters said it used a previously unknown zero-day vulnerability in Oracle PeopleSoft to access internal FBI systems. The hackers posted evidence of the breach on their dark web site and threatened to release more data if their demands were not met.

The FBI acknowledged awareness of the claims and began an investigation into the reported breach. Meanwhile, Clop was left dealing with the aftermath of the attack on its own infrastructure.

Currently, both the FBI and Clop are investigating the extent of the breaches. The FBI has not confirmed the full scope of the data loss or its authenticity, but security experts warn that any compromise of agent data could have serious national security implications.

ShinyHunters continues to demand that the FBI retract statements made about the group in previous threat reports. The situation remains fluid, with the potential for more data leaks if negotiations or investigations stall.

Key questions remain about whether the stolen FBI data is genuine and how much information could be exposed if released. The FBI's investigation may determine if agents or applicants are at risk, and whether the zero-day vulnerability has been patched. Observers are also watching for possible retaliation or further escalation among hacking groups.