Dark Web Digest – October 2026 Edition

In September 2026 the underground turned against itself. ShinyHunters took over a rival ransomware group’s leak site and then claimed it had breached the FBI. At the same time, a dark web service selling 153 million driver’s licence scans was linked to a US identity-verification firm, and police kept up the pressure through arrests and a $52 million crypto freeze.

Ransomware activity stayed well above last year’s level. Leak sites reported 789 victims in September, and 2026 is on track for about 9,100. The incidents that mattered most are listed below, most recent first. Missed last month? Catch up with [Internal link: Dark Web Digest, September edition].

Law enforcement arrests and seizures

Police made two moves that will shape the coming months, an arrest inside the ShinyHunters orbit and a major operation against a scam-services marketplace.

A Dutch man was arrested in the ShinyHunters investigation. According to Krebs on Security, a 24-year-old man was detained by Dutch authorities on or about 16 September on suspicion of helping ShinyHunters with data theft and extortion. He had already been convicted in 2023 for a series of extortions and was released from prison in December 2025. Dutch police confirmed the arrest on 28 September. The FBI’s cyber division publicly thanked the Dutch authorities and urged the remaining members to turn themselves in.

The arrest came while Dutch police were already asking the public to identify the voice of a ShinyHunters caller who gained access to telecom provider Odido in February 2026, a breach that affected more than 6.2 million people. Sources told Krebs that the group’s leadership has since passed to a teenage member linked to the Scattered LAPSUS$ Hunters collective, which might explain its sudden shift to riskier targets.

The Xinbi Guarantee marketplace was disrupted. On 9 September, the US Justice Department’s Scam Center Strike Force acted against Xinbi Guarantee, a Chinese-language marketplace operating on Telegram that sold services to scam compounds. Authorities seized its Telegram channels and froze approximately $52.8 million in USDT across 52 wallets. Researchers estimate that Xinbi has processed around $30 billion in transactions since 2022. In the same week, the Strike Force helped Madagascar dismantle 13 scam compounds run by Chinese nationals, resulting in nearly 400 arrests.

Empire Market co-creator sentenced. On 5 October, Raheim Hamilton, one of the co-creators of Empire Market, received a 40-year sentence and gave up approximately 1,230 bitcoin. The market handled over $430 million in sales between 2018 and 2020, and his co-founder’s sentencing is scheduled for later this month.

Breaches and leaks that surfaced underground

The biggest leak in September did not involve passwords but identity documents. A dark web site offered scans of over 153 million North American driver’s licences. That month GRC Solutions recorded 40 publicly disclosed incidents, with at least 252.8 million records confirmed and a further 164 million claimed by attackers.

Nexus and the IDScan breach. On 31 August a new seller on the Russian-language forum Exploit advertised “Nexus”, a searchable repository of ID scans from the United States and Canada. Krebs on Security traced the images back to IDScan.net, a Louisiana verification company used by car-rental desks, dispensaries and retailers. The records contained infrared and UV scans, and their number grew by approximately 400,000 within a single day. The FBI opened an inquiry on 1 September, and Nexus went offline that same evening. IDScan confirmed the breach in a statement issued on 4 September. Since then several parties have claimed to be reselling the complete set. For background on how stolen IDs are traded, see [Internal link: how identity data is sold on the dark web].

ShinyHunters and the FBI. On 22 September ShinyHunters announced on its leak site that it had breached the FBI through a vulnerability in Oracle PeopleSoft. The group released a sample of approximately 5,000 staff records, partly verified by 404 Media, and the FBI’s jobs portal went offline. It presented the attack as retaliation for a May FBI advisory that urged victims not to pay. Mandiant and Google later confirmed a renewed large-scale exploitation campaign against PeopleSoft across education, healthcare, government and other sectors. Security Affairs has more on the technical claims.

Other notable September disclosures

Ransomware leak sites and a gang war

According to Breachsense, ransomware leak sites reported 789 victims in September. That is 18% fewer than the 964 recorded in August, the busiest month of 2026, but still 30% higher than the 2025 monthly average. Check Point, which counts differently, recorded 824 attacks, an increase of 53% on the same month last year.

Who was most active. The Gentlemen led for the second time this year with 98 victims. Qilin followed with 75 (less than half its August count), then INC Ransom (40), Akira (39) and Krybit (35). LockBit, BrainCipher, Panzer and Emperador all returned to or entered the top 10. The United States accounted for 41% of victims, and healthcare was the most affected sector for the fourth month in a row with 89 victims. New to the topic? Read [Internal link: what is ransomware-as-a-service].

ShinyHunters hijacks Clop’s leak site. According to BleepingComputer, on the night of 18 September ShinyHunters defaced the Tor leak site of the Clop ransomware group, claiming it exploited an unauthenticated file-upload flaw in the Grav CMS behind the site. The group said it had taken Clop’s source code, logs and the private keys for its onion service. It then demanded an eight-figure bitcoin payment from Clop and threatened to reveal the names of companies that had paid Clop.

On 21 September Clop posted a reply on its own hijacked site, saying the contact address ShinyHunters gave did not work. The claims about stolen victim data have not been verified, but Dark Reading points out that the risk is real. Organisations that quietly paid Clop could now face a second extortion attempt from a group they never dealt with. SOCRadar has a full timeline of the dispute.

What to watch, and what to do

The following trends from September are likely to continue into October.

• Identity data is now the main target. Nexus showed that verification companies hold the same document scans that banks depend on. Expect more fraud built on real licence photographs rather than leaked passwords.
• Criminals hacking other criminals. The Clop hijack follows the BreachForums user-database leak in January. Leak sites and forums can be breached too, and their data then ends up with rivals and the police.
• Old flaws, new workarounds. ShinyHunters reportedly got past the temporary firewall rules for the PeopleSoft bug with a URL-encoding trick, Krebs on Security reports. Temporary fixes are no substitute for patches.

Practical steps for readers

1. If you rented a car, visited a dispensary or showed your ID at a scanner in the last year, consider freezing your credit and watch for new accounts opened in your name. Our guide [Internal link: how to protect yourself after an ID leak] walks through the steps.
2. If you reused your Gyazo password anywhere else, change it there too, and revoke Gyazo’s connected X and Google sessions.
3. Organisations using Oracle PeopleSoft should apply Oracle’s patch for CVE-2026-35273 instead of relying on firewall rules alone.
4. When resetting leaked credentials, also end active sessions, since stealer logs often include session tokens.

This article covers only publicly reported incidents. Many attacker claims have not been verified and are marked as such.

Sources

• Krebs on Security, FBI Probes Service Selling 153M+ Drivers Licenses
• Krebs on Security, Dutch Police Arrest ‘Reformed’ Hacker in ShinyHunters Investigation
• BleepingComputer, IDScan confirms breach tied to 153 million stolen driver’s licenses
• BleepingComputer, ShinyHunters hacks Clop leak site
• BleepingComputer, ShinyHunters claims FBI hack
• Reuters via Daily Maverick, ShinyHunters hackers say they breached FBI
• Security Affairs, ShinyHunters claims FBI breach after alleged PeopleSoft zero-day
• Malwarebytes, ShinyHunters claims FBI breach was revenge
• The Record, ShinyHunters takes over Cl0p ransomware site
• Dark Reading, ShinyHunters Hacked Clop. Now What About Clop’s Victims?
• SOCRadar, Clop Hack Timeline
• The Hacker News, US disrupts Xinbi Guarantee
• Gulf News, Madagascar scam hubs dismantled with US help
• Rep. Meuser statement on Scam Center Strike Force
• Hackread, Empire Market co-creator sentenced
• CoinDesk, Empire Market operator forfeits 1,230 BTC
• eSecurity Planet, BreachForums data breach exposes 324,000 users
• Breachsense, September 2026 Ransomware Report
• Techeconomy, Check Point September 2026 threat data
• GRC Solutions, Global Data Breaches and Cyber Attacks in September 2026