INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI Suffers Breach, Clop Hijacks IDScan

| 2026-10-27 14:00 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A major cyber attack occurred in September 2026, with the FBI being breached and a Dark Web service advertising over 153 million US and Canadian driver's license scans linked to an identity verification provider. The breach was attributed to North Korean patterns by Bitget's CEO, while blockchain analysts linked funds used for laundering earlier North Korea-attributed attacks to wallets involved in this incident. This attack affected hundreds of organizations compromised by a single actor using AI agents, with sensitive customer and patient data from US utilities, healthcare technology companies, and major fintech firms also disclosed. The attackers exploited an unpatched Oracle PeopleSoft zero-day flaw, which was later confirmed as CVE-2026-35273, to gain access to the FBI's systems through Amazon Web Services (AWS) GovCloud.
Technical Mitigations AI-generated
• Patch Oracle PeopleSoft zero-day CVE-2026-35273 immediately to prevent exploitation by ShinyHunters. • Monitor AWS GovCloud for signs of unauthorized access and implement additional security measures to protect against data breaches like the one claimed by ShinyHunters. • Regularly review and update plugins, source code, logs, and private keys in Grav content management systems to prevent abuse by threat actors.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ZIRCONIUMZIRCONIUMShinyHuntersShinyHuntersThe GentlemenThe Gentlemen CVE-2026-42608CVE-2026-42608 CVE-2026-87491CVE-2026-87491 CVE-2026-81578CVE-2026-81578 CVE-2026-82078CVE-2026-82078 CVE-2026-85046CVE-2026-85046 CVE-2026-88772CVE-2026-88772 CVE-2026-88771CVE-2026-88771 CVE-2026-85880CVE-2026-85880 CVE-2026-35273CVE-2026-35273
Target & Sectors
DPRK DPRK NORTH_AMERICA NORTH_AMERICA ASEAN ASEAN governmentgovernment healthhealth technologytechnology financefinance cryptocurrencycryptocurrency
Incident Timeline
‎September 3 and 4, 2026
Threat actors, tracked as UTA0560 and UTA0565, used phishing tactics to target US-based NGOs on September 1, 2026.
target_region United States
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
organisation GRIMWEDGE JScript backdoor
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
organisation UTA0565
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
‎January 2019
Threat actors exploited a vulnerability to hijack the Clop malware, leading to unauthorized access and leak of approximately 490 million image metadata records from Gyazo.
data_breach 490 metadata records
The attacker also reached about 490 million image metadata records, mostly for images uploaded in January 2019 or earlier.
organisation Gyazo
Those metadata records hold the IDs that make up Gyazo image links, so they could be used to view private images without permission.
‎April 2026
Threat actors exploited the vulnerability in Clop's 1.7 branch, which was not patched until version 1.7.53.4 shipped on September 24, 2026.
infrastructure 2.0
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
infrastructure 1.7
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
infrastructure 1.7.53
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
general_metric 2.0 version
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
general_metric 1.7 branch
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
‎May 2026
Threat actors ShinyHunters exploited a previously disclosed PeopleSoft vulnerability, CVE-2026-35273, to target the FBI's Canvas campaign.
threat_actor ShinyHunters
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
vulnerability CVE-2026-35273
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
attribution FBI
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
organisation Canvas
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
‎June 2026
ShinyHunters exploited the previously disclosed PeopleSoft flaw CVE-2026-35273 in June 2026.
threat_actor ShinyHunters
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
vulnerability CVE-2026-35273
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
attribution FBI
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
organisation Canvas
ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273 , in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
‎August 7, 2026
Threat actors exploited a patch gap in Chrome to gain unauthorized access, coinciding with the FBI breach and IDScan leak.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
‎August 27, 2026
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation PaperCut
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
organisation Known Exploited
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
tactic T1588.006 - Vulnerabilities
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
organisation KEV
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
‎August 28, 2026
Threat actors associated with APT31 installed the LONGTALE malicious browser extension on a user's device, marking the first observed incident of this actor.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
threat_actor ZIRCONIUM
APT31 was the first observed user, on August 28, 2026, and later installed the LONGTALE malicious browser extension.
organisation LONGTALE
APT31 was the first observed user, on August 28, 2026, and later installed the LONGTALE malicious browser extension.
‎August 31, 2026
Threat actors used the BlueMoon exploit kit to target at least 280 victims, including 20 in eight countries where agents failed to follow instructions.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation PaperCut
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
organisation Known Exploited
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
tactic T1588.006 - Vulnerabilities
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
organisation KEV
Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
infrastructure Windows
BlueMoon Zero-Day Chain Reached at Least Four Espionage Clusters A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
organisation Google Chrome
BlueMoon Zero-Day Chain Reached at Least Four Espionage Clusters A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
organisation Microsoft
BlueMoon Zero-Day Chain Reached at Least Four Espionage Clusters A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
victims 280 victims
The attacker built target lists through the Netlas scanning platform, harvested credentials from 280 victims, pulled operating system or domain secrets from 147, and reached domain administrator access at 12.
victims 20 victims
The agents also did not consistently honor instructions to avoid 28 countries, and 20 victims sat in eight of them.
‎September 1, 2026
Threat actors used a Windows Advanced Local Procedure Call (ALPC) heap overflow vulnerability to target US-based non-governmental organizations via phishing, which then exploited multiple vulnerabilities including V8 type confusion and out-of-bounds write flaws.
target_region United States
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
organisation Nexus
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
target_region Canada
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
general_metric 153 license scans
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
general_metric 10 ID cards
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
general_metric 3 travel documents
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
general_metric 579,000 medical cards
The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards.
organisation GRIMWEDGE JScript backdoor
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
organisation UTA0565
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
infrastructure Windows
CVE-2026-85880 , a Windows Advanced Local Procedure Call (ALPC) heap overflow, then escapes the renderer sandbox and elevates privileges.
‎September 2, 2026
Researchers used exploits for CVE-2026-81578 and CVE-2026-82078 to target at least 440 compromised instances across 395 organizations in 48 countries.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
victims 395 Organizations
Researchers counted at least 440 compromised instances across 395 organizations in 48 countries, and 204 of those instances belonged to education.
organisation PoC
Running on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078 , drawing on public proof-of-concept (PoC) code and patched builds.
‎September 3, 2026
Threat actors exploited a patch gap in Chrome to gain unauthorized access, coinciding with the FBI breach and IDScan leak on September 3, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
‎September 4, 2026
At least nine class actions were filed by September 4, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation KYC
Unlike passwords, licenses cannot be reset, so the scans can fuel account takeover, synthetic identity fraud, and Know Your Customer (KYC) bypass for years.
‎September 5, 2026
The Gentlemen claimed 237 victims in the 60 days before listing Veradigm's breach on its Dark Web leak site, where it threatened to publish 3.5 million patient records unless paid a ransom.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
tactic Ransomware
The filing came three days after the ransomware group The Gentlemen added Veradigm to its Dark Web leak site on September 5, 2026.
threat_actor The Gentlemen
The filing came three days after the ransomware group The Gentlemen added Veradigm to its Dark Web leak site on September 5, 2026.
Veradigm listing on The Gentlemen’s leak site The group claims it holds 3.5 million patient records and threatened to publish them unless Veradigm paid.
SOCRadar’s breach record for Veradigm shows The Gentlemen claimed 237 victims in the 60 days before the listing.
data_breach 3.5 Records technology company
Veradigm listing on The Gentlemen’s leak site The group claims it holds 3.5 million patient records and threatened to publish them unless Veradigm paid.
organisation Veradigm
Veradigm listing on The Gentlemen’s leak site The group claims it holds 3.5 million patient records and threatened to publish them unless Veradigm paid.
victims 237 victims
SOCRadar’s breach record for Veradigm shows The Gentlemen claimed 237 victims in the 60 days before the listing.
‎September 8, 2026
The Gentlemen claimed 3.5 million Veradigm patient records, following a previously undisclosed third-party vendor breach that occurred in September 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
infrastructure Windows
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
infrastructure 152.0.7977
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
infrastructure 153.0.8010
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
organisation Google
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
threat_actor The Gentlemen
The Gentlemen Claimed 3.5 Million Veradigm Patient Records Healthcare technology company Veradigm, formerly Allscripts, disclosed in a Form 8-K on September 8, 2026, that one of its third-party vendors suffered a cybersecurity incident affecting data tied to a small number of its customers.
organisation Allscripts
The Gentlemen Claimed 3.5 Million Veradigm Patient Records Healthcare technology company Veradigm, formerly Allscripts, disclosed in a Form 8-K on September 8, 2026, that one of its third-party vendors suffered a cybersecurity incident affecting data tied to a small number of its customers.
data_breach 3.5 Records technology company
The Gentlemen Claimed 3.5 Million Veradigm Patient Records Healthcare technology company Veradigm, formerly Allscripts, disclosed in a Form 8-K on September 8, 2026, that one of its third-party vendors suffered a cybersecurity incident affecting data tied to a small number of its customers.
threat_actor ZIRCONIUM
Researchers assess the clusters as China-linked, and a 2024 US indictment tied APT31 to China’s Ministry of State Security, though no government has attributed the BlueMoon activity itself.
organisation Ministry of State Security
Researchers assess the clusters as China-linked, and a 2024 US indictment tied APT31 to China’s Ministry of State Security, though no government has attributed the BlueMoon activity itself.
organisation BlueMoon
Researchers assess the clusters as China-linked, and a 2024 US indictment tied APT31 to China’s Ministry of State Security, though no government has attributed the BlueMoon activity itself.
data_breach 4 September
CISA added all three to the KEV catalog between September 4 and 9, 2026.
data_breach 9 September
CISA added all three to the KEV catalog between September 4 and 9, 2026.
data_breach 2026 September
CISA added all three to the KEV catalog between September 4 and 9, 2026.
‎September 11, 2026
Threat actors exploited a vulnerability in Gyazo's image upload server to gain unauthorized access, which was later hijacked by Clop and resulted in the leak of IDScan data.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
‎September 12, 2026
Threat actors impersonating a government agency obtained sensitive customer data, including identity and financial records, from Revolut.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation Revolut Handed Customer Data
Revolut Handed Customer Data to a Fake Government Request Fintech company Revolut confirmed on September 12, 2026, that it shared data on an undisclosed number of customers with a threat actor impersonating a government agency.
organisation Revolut
Revolut Handed Customer Data to a Fake Government Request Fintech company Revolut confirmed on September 12, 2026, that it shared data on an undisclosed number of customers with a threat actor impersonating a government agency.
organisation International Bank Account Numbers
The disclosed data included identity and contact details, copies of passports or driver’s licenses, KYC verification selfies, International Bank Account Numbers (IBANs), and other financial records.
organisation XMR
Crypto fraud investigator ZachXBT said the activity appeared aimed at high-net-worth users, and a group calling itself “iamnotavillain” later demanded 6,000 XMR, about $3 million, though Revolut said it received no direct demand.
financial $3 XMR
Crypto fraud investigator ZachXBT said the activity appeared aimed at high-net-worth users, and a group calling itself “iamnotavillain” later demanded 6,000 XMR, about $3 million, though Revolut said it received no direct demand.
victims 80 customers
Revolut, which serves more than 80 million customers, said only a limited number were affected and that its systems and customer funds were untouched.
‎September 14, 2026
Threat actors hijacked Clop, a ransomware group, to steal sensitive data from CenterPoint and leak it on the dark web.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
target_region United States
CenterPoint’s Form 8-K, filed with the US Securities and Exchange Commission (SEC) on September 14, 2026, confirms the theft but gives no victim count or data types, and says electric and gas service was not affected.
organisation CenterPoint
CenterPoint’s Form 8-K, filed with the US Securities and Exchange Commission (SEC) on September 14, 2026, confirms the theft but gives no victim count or data types, and says electric and gas service was not affected.
organisation the US Securities and Exchange Commission
CenterPoint’s Form 8-K, filed with the US Securities and Exchange Commission (SEC) on September 14, 2026, confirms the theft but gives no victim count or data types, and says electric and gas service was not affected.
organisation SEC
CenterPoint’s Form 8-K, filed with the US Securities and Exchange Commission (SEC) on September 14, 2026, confirms the theft but gives no victim count or data types, and says electric and gas service was not affected.
‎September 15, 2026
Threat actors hijacked Gyazo's systems, causing images to fail to load while simultaneously breaching the platform and leaking user IDScan data.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
target_region Japan
Helpfeel fixed the flaw by the next day and reported the breach to Japan’s Personal Information Protection Commission on September 15, 2026.
organisation Gyazo’s
While images were failing to load, Gyazo’s public notices described the outage as maintenance.
‎September 16, 2026
A breach of Helpfeel's Gyazo image-sharing service exposed approximately 23.62 million user records, including email addresses and password hashes.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation Gyazo Breach
Gyazo Breach Exposed 23.62 Million User Records Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes.
organisation Helpfeel
Gyazo Breach Exposed 23.62 Million User Records Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes.
general_metric 23.62 based Helpfeel
Gyazo Breach Exposed 23.62 Million User Records Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes.
data_breach 23.62 user records
Gyazo Breach Exposed 23.62 Million User Records Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes.
‎September 18, 2026
ShinyHunters hijacked Clop's Dark Web leak site, abusing a Grav content management system flaw to deface it and set a 72-hour deadline.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
tactic Ransomware
ShinyHunters Hijacked Clop’s Leak Site and Set a 72-Hour Deadline On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it.
threat_actor ShinyHunters
ShinyHunters Hijacked Clop’s Leak Site and Set a 72-Hour Deadline On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it.
Clop’s Dark Web leak site, stating “Domain Seized by ShinyHunters.”
organisation CMS
ShinyHunters Hijacked Clop’s Leak Site and Set a 72-Hour Deadline On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it.
general_metric 72 Hour
ShinyHunters Hijacked Clop’s Leak Site and Set a 72-Hour Deadline On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it.
organisation Domain Seized
Clop’s Dark Web leak site, stating “Domain Seized by ShinyHunters.”
organisation Tor
Clop moved its leak site to a new Tor address and confirmed the compromise came through a Grav path traversal flaw, CVE-2026-42608 .
‎September 22, 2026
ShinyHunters claimed to have breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
threat_actor ShinyHunters
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
The FBIJobs.gov recruitment site displayed a “seized by ShinyHunters” banner and went offline.
data_breach 5,000 purported employee records
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
attribution FBI
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
attribution FBI Breach
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
organisation Purported Staff Records
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
organisation Oracle PeopleSoft
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
organisation PeopleSoft
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
organisation Amazon
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
organisation TB
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
data_breach 3 TB
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
‎September 24, 2026
Suspected North Korean Hackers used Clop's vulnerable server to steal $387.5 million from Bitget cryptocurrency exchange on September 24, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
infrastructure 2.0
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
infrastructure 1.7
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
infrastructure 1.7.53
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
general_metric 2.0 version
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
general_metric 1.7 branch
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
source_region DPRK
Suspected North Korean Hackers Stole $387.5 Million From Bitget Cryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026.
organisation Suspected North Korean Hackers Stole
Suspected North Korean Hackers Stole $387.5 Million From Bitget Cryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026.
financial $387.5 Hackers
Suspected North Korean Hackers Stole $387.5 Million From Bitget Cryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026.
threat_actor ShinyHunters
Clop said the server held only website content and denied any contact with ShinyHunters, which later removed Clop from its leak site.
‎September 27, 2026
Threat actors exploited two critical NetScaler ADC and Gateway flaws, CVE-2026-88771 and CVE-2026-88772, to target up to 120,000 hosts per run.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
infrastructure 14.1-73
CISA added both flaws to the KEV catalog on September 27, 2026, and Citrix’s fixed builds start at 14.1-73.37 and 13.1-64.23.
infrastructure 13.1-64
CISA added both flaws to the KEV catalog on September 27, 2026, and Citrix’s fixed builds start at 14.1-73.37 and 13.1-64.23.
organisation NetScaler ADC
SOCRadar Found NetScaler C2 Hunting Up to 120,000 Hosts per Run Citrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack.
infrastructure 120,000 Hosts
SOCRadar Found NetScaler C2 Hunting Up to 120,000 Hosts per Run Citrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack.
organisation Datagram Transport Layer Security
CVE-2026-88772 (9.5 CVSS v4.0) is a memory overflow that can lead to RCE or denial of service on appliances with Datagram Transport Layer Security (DTLS) enabled, the default for VPN virtual servers.
organisation DTLS
CVE-2026-88772 (9.5 CVSS v4.0) is a memory overflow that can lead to RCE or denial of service on appliances with Datagram Transport Layer Security (DTLS) enabled, the default for VPN virtual servers.
‎September 28, 2026
Threat actors exploited the CVE-2026-88771 vulnerability to hijack Clop, leading to a breach of IDScan and subsequent intrusions into finance, health, technology, cryptocurrency, and government systems.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
tactic Lateral Movement
Intrusions led to web shells, credential theft, and lateral movement, and mass exploitation of CVE-2026-88771 began on September 28, 2026.
vulnerability CVE-2026-88771
Intrusions led to web shells, credential theft, and lateral movement, and mass exploitation of CVE-2026-88771 began on September 28, 2026.
organisation CVE-2026
Intrusions led to web shells, credential theft, and lateral movement, and mass exploitation of CVE-2026-88771 began on September 28, 2026.
‎September 29, 2026
Threat actors hijacked the Clop ransomware group to target and breach the VeriScan platform, resulting in unauthorized access from April 4 to September 2, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
‎early September 2026
Threat actors exploited CVE-2026-88772 vulnerability in early September 2026, three days before a breach was detected.
vulnerability CVE-2026-88772
An exploitation attempt was spotted three days earlier, and incident responders traced CVE-2026-88772 activity back to early September 2026.
‎September 2026
ShinyHunters hijacked the Clop ransomware gang's Dark Web leak site, leading to a breach of the Federal Bureau of Investigation (FBI) four days later.
attribution FBI Breach
September 2026: FBI Breach, Clop Hijack & IDScan Leak.
organisation Dark
Identity data drove the month’s biggest numbers, led by a data breach linked to a Dark Web service advertising more than 153 million driver’s license scans.
victims 395 Organizations
One actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days.
infrastructure Windows
One actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days.
threat_actor ShinyHunters
ShinyHunters hijacked the Clop ransomware gang’s Dark Web leak site and, four days later, claimed a breach of the Federal Bureau of Investigation (FBI).
‎October 1, 2026
Threat actors using the alias "4d722e4d656f77" exploited a vulnerable public API, enumerated and leaked 7.49 million customer records from CenterPoint Energy's systems.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation SOCRadar
On October 1, 2026, SOCRadar’s Threat Research Unit identified NetScaler C2 , an autonomous framework that runs every 30 minutes.
organisation Threat Research Unit
On October 1, 2026, SOCRadar’s Threat Research Unit identified NetScaler C2 , an autonomous framework that runs every 30 minutes.
organisation NetScaler
On October 1, 2026, SOCRadar’s Threat Research Unit identified NetScaler C2 , an autonomous framework that runs every 30 minutes.
general_metric 30 minutes
On October 1, 2026, SOCRadar’s Threat Research Unit identified NetScaler C2 , an autonomous framework that runs every 30 minutes.
organisation CenterPoint Energy Data Theft
CenterPoint Energy Data Theft Reached More Than 1 Million Texans US utility CenterPoint Energy confirmed that an attacker obtained customer personal information through one of its external-facing systems.
organisation CenterPoint Energy
CenterPoint Energy Data Theft Reached More Than 1 Million Texans US utility CenterPoint Energy confirmed that an attacker obtained customer personal information through one of its external-facing systems.
organisation FOFA
Each cycle pulls exposed hosts from FOFA, fingerprints their versions, exploits CVE-2026-88771, and deploys an agent that polls for operator commands.
infrastructure 120,000 Hosts
NetScaler C2’s attack pipeline A single run can enumerate up to 120,000 candidate hosts, against roughly 23,000 exposed NetScaler instances online.
organisation Social Security
The actor, using the alias “4d722e4d656f77”, claims it took 7.49 million customer records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs).
data_breach 7.49 customer records
The actor, using the alias “4d722e4d656f77”, claims it took 7.49 million customer records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs).
organisation API
It said it pulled the records from a public application programming interface (API) that lacked rate limiting, and leaked them after the company ignored its messages.
‎October 2, 2026
Threat actors, linked to known North Korean patterns, hijacked Bitget's cryptocurrency accounts and laundered stolen ETH, XRP, BNB, AVAX, USDT, and USDC across seven blockchain chains.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation Bitget’s
Bitget’s CEO said the attack matched known North Korean patterns, and blockchain analysts linked the funds to wallets used to launder earlier North Korea-attributed heists, including the 2025 Bybit theft.
organisation ETH
The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
organisation XRP
The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
organisation BNB
The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
organisation USDT
The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
organisation USDC
The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
organisation Bitget’s User Protection Fund
The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
‎October 5, 2026
The FBI's Cyber Division announced on October 5, 2026, that a contractor had failed to apply an available patch, leading to the hijacking of Clop ransomware and subsequent leak of IDScan data.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
organisation Cyber Division
On October 5, 2026, its Cyber Division said a contractor had failed to apply an available patch and that the bureau had removed the contractor.
‎October 9, 2026
The FBI Director announced the arrest of a suspected ShinyHunters co-conspirator on October 9, 2026.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
threat_actor ShinyHunters
On October 9, 2026, FBI Director Kash Patel said the intrusion occurred on a third-party vendor’s platform and announced the arrest of another suspected ShinyHunters co-conspirator.
attribution FBI
On October 9, 2026, FBI Director Kash Patel said the intrusion occurred on a third-party vendor’s platform and announced the arrest of another suspected ShinyHunters co-conspirator.
‎October 27, 2026
The FBI breach, attributed to the Clop hijack and IDScan leak, involved unauthorized access to customer data in Oracle's PeopleSoft system.
industry Finance
General Document Context
industry Health
General Document Context
industry Technology
General Document Context
industry Cryptocurrency
General Document Context
industry Government
General Document Context
attribution FBI
As of October 27, 2026, Oracle has not confirmed a new PeopleSoft zero-day, and SOCRadar’s analysis of the FBI breach claim covers the incident in more depth.
organisation Oracle
As of October 27, 2026, Oracle has not confirmed a new PeopleSoft zero-day, and SOCRadar’s analysis of the FBI breach claim covers the incident in more depth.
organisation TraderTraitor
One analysis pointed to the TraderTraitor group, but as of October 27, 2026, no government has attributed the attack.
organisation IDScan Confirmed
IDScan Confirmed Breach Linked to 153 Million License Scans Identity verification provider IDScan.net confirmed that an unauthorized party accessed customer data in its cloud platform.
infrastructure Windows
Vulnerability Intelligence : Prioritizes patching with exploited-in-the-wild context for zero-days like those seen in PeopleSoft, PaperCut, Chrome, and Windows this month.
financial $1 theft
If the attribution holds, suspected North Korean crypto theft in 2026 passes $1 billion, the second-largest year on record.
organisation Attack Surface Management
Attack Surface Management : Discovers internet-facing assets such as VPN gateways, print servers, and APIs, and flags exposures attackers could use.
organisation Yağmur Ernalbant Yağmur
Yağmur Ernalbant Yağmur is a Senior Content Development Specialist at SOCRadar, covering both breaking cybersecurity news and the broader issues behind it.
‎August 27 and September 2, 2026
A Russian-speaking actor exploited vulnerabilities in PaperCut NG/MF print management servers to compromise hundreds of AI agents, which were then used to target 395 organizations between August 27 and September 2, 2026.
target_region Russian Federation
AI Agents Compromised 395 Organizations Through PaperCut Flaws A likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026.
organisation PaperCut NG/MF
AI Agents Compromised 395 Organizations Through PaperCut Flaws A likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026.
victims 395 Organizations
AI Agents Compromised 395 Organizations Through PaperCut Flaws A likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026.
‎April 4 to September 2, 2026
Threat actors exploited a vulnerability in the VeriScan platform, resulting in unauthorized access from April 4 to September 2, 2026.
‎August 17 to September 1, 2026
Threat actors allegedly breached the FBI's systems from August 17 to September 1, 2026.
Tactical Metrics
Metrics
victims
395
Organizations
AI Agents Compromised 395 Organizations Through PaperCut Flaws A likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026.
One actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days.
Researchers counted at least 440 compromised instances across 395 organizations in 48 countries, and 204 of those instances belonged to education.
Metrics
infrastructure
‎Windows
Affected Product
One actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days.
BlueMoon Zero-Day Chain Reached at Least Four Espionage Clusters A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
CVE-2026-85880 , a Windows Advanced Local Procedure Call (ALPC) heap overflow, then escapes the renderer sandbox and elevates privileges.
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
Vulnerability Intelligence : Prioritizes patching with exploited-in-the-wild context for zero-days like those seen in PeopleSoft, PaperCut, Chrome, and Windows this month.
Metrics
data_breach
3
Tb
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
Metrics
data_breach
5,000
Purported Employee Records
ShinyHunters’ defacement and breach claim The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.
ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.
Metrics
infrastructure
‎2.0
Software Version
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
Metrics
infrastructure
‎1.7
Software Version
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
Metrics
infrastructure
‎1.7.53
Software Version
Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026.
Metrics
financial
387,500,000
Financial Impact / Stolen Funds
Suspected North Korean Hackers Stole $387.5 Million From Bitget Cryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026.
Metrics
financial
1,000,000,000
Financial Impact / Stolen Funds
If the attribution holds, suspected North Korean crypto theft in 2026 passes $1 billion, the second-largest year on record.
Metrics
infrastructure
‎152.0.7977
Software Version
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
Metrics
infrastructure
‎153.0.8010
Software Version
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release.
Metrics
infrastructure
‎14.1-73
Software Version
CISA added both flaws to the KEV catalog on September 27, 2026, and Citrix’s fixed builds start at 14.1-73.37 and 13.1-64.23.
Metrics
infrastructure
‎13.1-64
Software Version
CISA added both flaws to the KEV catalog on September 27, 2026, and Citrix’s fixed builds start at 14.1-73.37 and 13.1-64.23.
Metrics
data_breach
4
September
CISA added all three to the KEV catalog between September 4 and 9, 2026.
Metrics
data_breach
9
September
CISA added all three to the KEV catalog between September 4 and 9, 2026.
Metrics
data_breach
2,026
September
CISA added all three to the KEV catalog between September 4 and 9, 2026.
Metrics
infrastructure
120,000
Hosts
SOCRadar Found NetScaler C2 Hunting Up to 120,000 Hosts per Run Citrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack.
NetScaler C2’s attack pipeline A single run can enumerate up to 120,000 candidate hosts, against roughly 23,000 exposed NetScaler instances online.
Metrics
data_breach
7,490,000
Customer Records
The actor, using the alias “4d722e4d656f77”, claims it took 7.49 million customer records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs).
Metrics
data_breach
23,620,000
User Records
Gyazo Breach Exposed 23.62 Million User Records Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes.
Metrics
data_breach
490,000,000
Metadata Records
The attacker also reached about 490 million image metadata records, mostly for images uploaded in January 2019 or earlier.
Metrics
financial
3,000,000
Xmr
Crypto fraud investigator ZachXBT said the activity appeared aimed at high-net-worth users, and a group calling itself “iamnotavillain” later demanded 6,000 XMR, about $3 million, though Revolut said it received no direct demand.
Metrics
data_breach
3,500,000
Records Technology Company
The Gentlemen Claimed 3.5 Million Veradigm Patient Records Healthcare technology company Veradigm, formerly Allscripts, disclosed in a Form 8-K on September 8, 2026, that one of its third-party vendors suffered a cybersecurity incident affecting data tied to a small number of its customers.
Veradigm listing on The Gentlemen’s leak site The group claims it holds 3.5 million patient records and threatened to publish them unless Veradigm paid.
Metrics
victims
237
Victims
SOCRadar’s breach record for Veradigm shows The Gentlemen claimed 237 victims in the 60 days before the listing.
Metrics
victims
280
Victims
The attacker built target lists through the Netlas scanning platform, harvested credentials from 280 victims, pulled operating system or domain secrets from 147, and reached domain administrator access at 12.
Metrics
victims
20
Victims
The agents also did not consistently honor instructions to avoid 28 countries, and 20 victims sat in eight of them.
Metrics
victims
80,000,000
Customers
Revolut, which serves more than 80 million customers, said only a limited number were affected and that its systems and customer funds were untouched.
Intelligence Sources
SOCRadar CTI Blog 2026-10-27