The week in breach news Sep 30, 2026

The FBI reportedly declared a "major incident" and notified its agents and support staff after a cyberattack on its job application portal FBIJobs.gov.

Last week, the ShinyHunters ransomware group claimed it breached the FBI's job application portal and stole data on thousands of agents and applicants. The FBI has since issued an internal notification to staff confirming that names, addresses, job titles and Social Security numbers were exposed in the incident. Unusually, the hackers are not seeking a financial ransom but are instead demanding the correction of an earlier FBI-issued report that they claim misrepresents their activities.

The attack is the latest in a growing pattern of cyberattacks targeting U.S. federal agencies. The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a separate data breach only last month.

The FBI is also investigating a separate data breach at a Pentagon personnel database that may have exposed personal information belonging to close to three million individuals.

Between October 2025 and July 2026, a Defense Manpower Data Center (DMDC) information system experienced unauthorized access by some users. The DMDC serves as one of the Pentagon's main repositories for personnel records, holding information on active-duty and reserve troops, civilian employees, contractors, retirees, veterans and military family members. The breach affected 2.76 million living individuals and another 294,000 deceased persons, with exposed information including Social Security numbers and details about the jobs they held.

The scope and sensitivity of the exposed data could raise significant national security concerns, particularly given that the compromised files included details about the roles and responsibilities of military and civilian personnel.

Dyfed-Powys Police, a territorial police force in Wales and the third largest police force in the UK, confirmed it was compromised in a cyberattack.

Dyfed-Powys covers the counties of Carmarthenshire, Ceredigion, Pembrokeshire and Powys in Wales. The force said it was hacked on September 14 in an incident that disrupted some non-emergency systems. While there was no evidence that personal data belonging to members of the public had been affected, the force acknowledged that staff information may have been accessed or compromised in the attack.

Online and email contact services were unavailable for a period following the attack but have since been restored. The force confirmed it remained fully operational throughout the incident and that its response to emergency calls was not affected.

Cryptocurrency exchange Bitget confirmed that attackers stole approximately $388 million after exploiting a vulnerability in a third-party security product used by the exchange.

On September 24, Bitget noticed unauthorized transfers from some of its wallets and temporarily suspended customer withdrawals while it investigated. The stolen funds came from a portion of the exchange's hot and warm wallets, with cold wallets remaining unaffected. While most customer funds are kept in offline cold wallets, hot and warm wallets are used to process withdrawals, with transfers still requiring approval before they are signed.

Bitget has not disclosed exactly how the attacker gained initial access, but the investigation found that the attacker compromised a critical backend system within its wallet infrastructure and spoofed transaction data to trigger the approval process.

Apple released iOS and macOS updates on September 28 to patch a zero-day vulnerability that may have been actively exploited in targeted attacks.

The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when processing a specially crafted file. While Apple has not disclosed how the malicious file is delivered, CoreGraphics handles 2D graphics and PDF rendering across the operating system, meaning it could potentially arrive via web pages, email attachments or messaging apps, where automatic attachment and link previews could enable zero-click exploitation.

Meanwhile, Apple confirmed it is aware of a report that the vulnerability may have been exploited in an extremely sophisticated attack targeting specific individuals on versions of iOS prior to iOS 27.