September 2026: FBI Breach, Clop Hijack & IDScan Leak

The major cyber attacks of September 2026 hit federal law enforcement, a rival cybercrime gang, and the companies that verify identities. ShinyHunters hijacked the Clop ransomware gang’s Dark Web leak site and, four days later, claimed a breach of the Federal Bureau of Investigation (FBI). Identity data drove the month’s biggest numbers, led by adata breach linked to a Dark Web service advertising more than 153 million driver’s license scans.

AI agents also moved from research into real campaigns. One actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days. A US utility, a healthcare technology company, and a major fintech firm rounded out the month with disclosures involving sensitive customer and patient data.

Here are the majorcyber attacks, breaches, and threat campaigns reported or significantly updated in September 2026.

ShinyHunters Claimed FBI Breach With 5,000 Purported Staff Records

On September 22, 2026,ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants. The FBIJobs.gov recruitment site displayed a “seized by ShinyHunters” banner and went offline.

The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set. It also claimed to be using the zero-day against Fortune 500 companies, which remains unverified. ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273, in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.

The FBI’s own account points to a missed patch. On October 5, 2026, its Cyber Division said a contractor had failed to apply an available patch and that the bureau had removed the contractor. On October 9, 2026, FBI Director Kash Patel said the intrusion occurred on a third-party vendor’s platform and announced the arrest of another suspected ShinyHunters co-conspirator. As of October 27, 2026, Oracle has not confirmed a new PeopleSoft zero-day, and SOCRadar’sanalysis of the FBI breach claim covers the incident in more depth.

IDScan Confirmed Breach Linked to 153 Million License Scans

Identity verification provider IDScan.net confirmed that an unauthorized party accessed customer data in its cloud platform. The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards. The FBI’s New Orleans field office opened an investigation the same day.

IDScan’s breach notice, first posted on September 4, 2026, is hidden from search engines. A September 29, 2026, update says the access ran from April 4 to September 2, 2026, and was limited to the VeriScan platform. Exposed data may include full names, contact details, dates of birth, and driver’s license, passport, or other government ID numbers, though the notice still does not mention the scans.

At least nine class actions were filed by September 4, 2026. Unlike passwords, licenses cannot be reset, so the scans can fuel account takeover, synthetic identity fraud, and Know Your Customer (KYC) bypass for years.

ShinyHunters Hijacked Clop’s Leak Site and Set a 72-Hour Deadline

On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it. The group claimed it stole server data, source code, plugins, logs, and the private keys for Clop’s onion service. It gave Clop 72 hours to make contact, added the gang to its own leak site, and tied the attack to a dispute over Clop’s 2025 Oracle E-Business Suite campaign.

Clop moved its leak site to a new Tor address and confirmed the compromise came through a Grav path traversal flaw, CVE-2026-42608. Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026. Clop said the server held only website content and denied any contact with ShinyHunters, which later removed Clop from its leak site.

If victim files were on the server, organizations that already paid Clop could face a second extortion attempt, a risk SOCRadar examined in itscoverage of the Clop leak site hijack.

Suspected North Korean Hackers Stole $387.5 Million From Bitget

Cryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026. It first put losses at $351.6 million, then raised the figure to $387.5 million after adding Zcash and TRON transfers. Cold wallets were not affected, and withdrawals resumed in phases from September 28, 2026, with all assets reopened by October 2, 2026.

Bitget traced the root cause to a zero-day in unnamed third-party security products, which gave the attacker privileged internal credentials. The attacker then compromised a critical backend system in the wallet infrastructure, spoofed transaction data, and triggered the exchange’s own authorization process. The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.

Bitget’s CEO said the attack matched known North Korean patterns, and blockchain analysts linked the funds to wallets used to launder earlier North Korea-attributed heists, including the 2025 Bybit theft. One analysis pointed to the TraderTraitor group, but as of October 27, 2026, no government has attributed the attack. If the attribution holds, suspected North Korean crypto theft in 2026 passes $1 billion, the second-largest year on record.

AI Agents Compromised 395 Organizations Through PaperCut Flaws

A likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026. Researchers counted at least 440 compromised instances across 395 organizations in 48 countries, and 204 of those instances belonged to education.

Running on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078, drawing on public proof-of-concept (PoC) code and patched builds. Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.

The attacker built target lists through the Netlas scanning platform, harvested credentials from 280 victims, pulled operating system or domain secrets from 147, and reached domain administrator access at 12. The agents also did not consistently honor instructions to avoid 28 countries, and 20 victims sat in eight of them. PaperCut’s fix is Emergency Patch Release 2 for the 24.x, 25.x, and 26.x branches, after the first emergency patch was bypassed; version 23.x and older will not receive a fix.

BlueMoon Zero-Day Chain Reached at Least Four Espionage Clusters

A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days. APT31 was the first observed user, on August 28, 2026, and later installed the LONGTALE malicious browser extension. On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP. Other clusters targeted a US aerospace company, a Vietnamese manufacturer, and organizations in Indonesia and Singapore.

The chain starts with CVE-2026-85046, a V8 type confusion flaw for code execution, and CVE-2026-87491, a V8 out-of-bounds write that escapes the V8 sandbox. CVE-2026-85880, a Windows Advanced Local Procedure Call (ALPC) heap overflow, then escapes the renderer sandbox and elevates privileges. The first Chrome bug was fixed in upstream Chromium on August 7, 2026, but the fix did not reach stable Chrome until September 3, 2026, a patch gap that left Chrome users exposed.

Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release. CISA added all three to the KEV catalog between September 4 and 9, 2026. Researchers assess the clusters as China-linked, and a 2024 US indictment tied APT31 to China’s Ministry of State Security, though no government has attributed the BlueMoon activity itself.

SOCRadar Found NetScaler C2 Hunting Up to 120,000 Hosts per Run

Citrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack. CVE-2026-88771 (9.5 CVSS v4.0) lets unauthenticated attackers run arbitrary commands, even on default configurations. CVE-2026-88772 (9.5 CVSS v4.0) is a memory overflow that can lead to RCE or denial of service on appliances with Datagram Transport Layer Security (DTLS) enabled, the default for VPN virtual servers.

Exploitation started before disclosure. An exploitation attempt was spotted three days earlier, and incident responders traced CVE-2026-88772 activity back to early September 2026. Intrusions led to web shells, credential theft, and lateral movement, and mass exploitation of CVE-2026-88771 began on September 28, 2026. CISA added both flaws to the KEV catalog on September 27, 2026, and Citrix’s fixed builds start at 14.1-73.37 and 13.1-64.23.

On October 1, 2026, SOCRadar’s Threat Research Unit identifiedNetScaler C2, an autonomous framework that runs every 30 minutes. Each cycle pulls exposed hosts from FOFA, fingerprints their versions, exploits CVE-2026-88771, and deploys an agent that polls for operator commands.

A single run can enumerate up to 120,000 candidate hosts, against roughly 23,000 exposed NetScaler instances online. Simplified Chinese code comments point to a Chinese-speaking operator using AI-assisted development, while the number of appliances it compromised remains unknown.

CenterPoint Energy Data Theft Reached More Than 1 Million Texans

US utility CenterPoint Energy confirmed that an attacker obtained customer personal information through one of its external-facing systems. The disclosure came after a threat actor leaked data allegedly stolen from the company.

The actor, using the alias “4d722e4d656f77”, claims it took 7.49 million customer records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs). It said it pulled the records from a public application programming interface (API) that lacked rate limiting, and leaked them after the company ignored its messages.

CenterPoint’s Form 8-K, filed with the US Securities and Exchange Commission (SEC) on September 14, 2026, confirms the theft but gives no victim count or data types, and says electric and gas service was not affected. A later notice to the Texas Attorney General puts the number of affected Texans at 1,062,060, with exposed data including names, addresses, SSNs, and driver’s license numbers. Proposed class actions allege the intrusion ran from August 17 to September 1, 2026.

Gyazo Breach Exposed 23.62 Million User Records

Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes. The figure includes anonymous accounts, and Helpfeel is still determining how many individuals are affected. The attacker also reached about 490 million image metadata records, mostly for images uploaded in January 2019 or earlier.

Those metadata records hold the IDs that make up Gyazo image links, so they could be used to view private images without permission. Helpfeel temporarily disabled viewing for some affected images and asked every user to change their password, along with any matching password reused on other services. No payment card data was exposed.

The intrusion began on September 11, 2026, through a vulnerability in Gyazo’s image upload server that let the attacker run arbitrary commands and reach the Gyazo database. Helpfeel fixed the flaw by the next day and reported the breach to Japan’s Personal Information Protection Commission on September 15, 2026. While images were failing to load, Gyazo’s public notices described the outage as maintenance.

Revolut Handed Customer Data to a Fake Government Request

Fintech company Revolut confirmed on September 12, 2026, that it shared data on an undisclosed number of customers with a threat actor impersonating a government agency. The request came from a legitimate government email domain and passed domain authentication checks, so Revolut fulfilled it in the belief that it was genuine. Reports trace the request to an Italian government email account, though Revolut has not named the agency.

The disclosed data included identity and contact details, copies of passports or driver’s licenses, KYC verification selfies, International Bank Account Numbers (IBANs), and other financial records. Revolut, which serves more than 80 million customers, said only a limited number were affected and that its systems and customer funds were untouched. Crypto fraud investigator ZachXBT said the activity appeared aimed at high-net-worth users, and a group calling itself “iamnotavillain” later demanded 6,000 XMR, about $3 million, though Revolut said it received no direct demand.

No network intrusion took place, which puts this incident beyond the reach of most technical controls. Any organization that answers government data requests faces the same exposure when a fraudulent request arrives from a legitimate agency domain.

The Gentlemen Claimed 3.5 Million Veradigm Patient Records

Healthcare technology company Veradigm, formerly Allscripts, disclosed in a Form 8-K on September 8, 2026, that one of its third-party vendors suffered a cybersecurity incident affecting data tied to a small number of its customers. The unauthorized party used credentials from the vendor’s environment against a Veradigm API to download copies of patient personal data, in some cases including SSNs. Veradigm said no clinical or medical data was involved.

The filing came three days after the ransomware group The Gentlemen added Veradigm to its Dark Web leak site on September 5, 2026.

The group claims it holds 3.5 million patient records and threatened to publish them unless Veradigm paid. SOCRadar’sbreach record for Veradigm shows The Gentlemen claimed 237 victims in the 60 days before the listing. As of October 27, 2026, Veradigm has not released a patient count.

How SOCRadar Can Help

September showed how often a breach starts outside an organization’s own network, through a vendor’s credentials, an exposed API, an unpatched server, or a post on a ransomware leak site. Catching those signals early gives security teams time to act before stolen data or access is used against them. SOCRadar provides several modules for monitoring this external risk:

• Dark Web Monitoring: Detects leaked data, compromised credentials, and ransomware leak site posts that mention your organization.

• Supply Chain Intelligence: Tracks breaches and cyber risk across your vendors and third parties.
• Attack Surface Management: Discovers internet-facing assets such as VPN gateways, print servers, and APIs, and flags exposures attackers could use.
• Vulnerability Intelligence: Prioritizes patching with exploited-in-the-wild context for zero-days like those seen in PeopleSoft, PaperCut, Chrome, and Windows this month.

Staying proactive with integrated threat intelligence and continuous monitoring remains essential as attack vectors evolve rapidly across third-party networks and zero-day vulnerabilities.