ShinyHunters FBI Breach Claim, Pentagon Data Exposure and DIVD Hack Discussed

Oct 9, 2026 · Original article ↗

Summary

Dark Reading discusses ShinyHunters' unverified FBI breach claim and recent arrests, exposed Pentagon-related records, and a DIVD breach involving two Zammad zero-days. Investigations into the Pentagon and DIVD incidents are ongoing.

Key points

ShinyHunters claimed, without evidence, to have stolen data on nearly every FBI employee and job applicant through a third-party jobs portal, which it also defaced.
Authorities in Jordan detained a suspected ShinyHunters member, reportedly cooperating with officials; Dutch authorities had also arrested another suspected member.
Threat actors reportedly accessed an unencrypted Pentagon-related file-sharing system for about nine months, exposing records associated with nearly 2.8 million living people and 294,000 deceased people.
The exposed records reportedly included Social Security numbers, names, birth dates, contact details, and military occupational information; officials said there was no indication of misuse and offered credit monitoring.
DIVD reported a breach involving two zero-day vulnerabilities in the Zammad platform, with data and employee information taken; its investigation was ongoing.
The speakers said the identity and intent of the actors behind the Pentagon and DIVD incidents were not confirmed, and any link to ShinyHunters or AI agents was speculative.

Article Details

Event Type: Multiple cybersecurity incidents discussed: ShinyHunters' alleged breach and defacement of an FBI-related jobs portal, unauthorized access to a Pentagon file-sharing system, and a breach of the Dutch Institute for Vulnerability Disclosure involving two zero-day vulnerabilities in Zammad.
Impact: ShinyHunters claimed, without evidence, to have obtained data belonging to nearly every FBI employee and job applicant; the article says the claim concerned a third-party jobs portal. The Pentagon file-sharing incident exposed records of nearly 2.8 million living people and 294,000 deceased people tied to the US military, including personal and military occupational information; officials said there was no indication the information had been misused. The DIVD breach involved theft of some organizational and employee data. A suspected ShinyHunters member was detained in Jordan and another suspected member was arrested by Dutch authorities.