SecOraLens
CriticalRansomware

September 2026: FBI Breach, Clop Hijack & IDScan Leak

SOCRadar·Source published ·1 min read

What happened?

The major cyber attacks of September 2026 hit federal law enforcement, a rival cybercrime gang, and the companies that verify identities. ShinyHunters hijacked the Clop ransomware gang’s Dark Web leak site and, four days later, claimed a breach of the Federal Bureau of Investigation (FBI). Identity data drove the month’s biggest numbers, led by a data breach linked to a Dark Web service advertising more than 153 million driver’s license scans. AI agents also moved from research into real campaigns.

Key details

  • ShinyHunters claimed FBI breach via unpatched Oracle PeopleSoft zero-day, stole employee records.
  • IDScan breach exposed data of 153 million driver's license scans and other identity documents.
  • ShinyHunters hijacked Clop ransomware leak site via Grav CMS path traversal flaw CVE-2026-42608.
  • BlueMoon zero-day chain chained Chrome and Windows flaws across at least four espionage clusters.
  • Gyazo breach exposed 23.62 million user records including email addresses and password hashes.
  • Revolut handed customer data to fake government request impersonating agency.

Affected

  • Google Chrome versions before 152.0.7977.82 and 153.0.8010.36
  • Microsoft Windows systems vulnerable to CVE-2026-85880
  • Citrix NetScaler ADC and Gateway appliances
  • CenterPoint Energy external-facing systems
  • Gyazo image-sharing service

Fixes and mitigations

  1. Grav CMS version 1.7.53.4 or later
  2. Microsoft Windows patch released September 8, 2026
  3. Citrix NetScaler fixed builds 14.1-73.37 and 13.1-64.23

Summarised by SecOraLens from SOCRadar. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories