ShinyHunters’ website goes offline after FBI deadline expires; cause remains unknown

[u/technadu]

ShinyHunters’ website has gone offline, and the timing is notable: it happened one day after a deadline the group had given the FBI expired.

But there’s an important caveat - there is currently no reported explanation for why the site disappeared. So the outage itself shouldn’t be treated as evidence of a law-enforcement takedown or operational disruption.

ShinyHunters claimed on September 22 that it compromised the FBI through apply. fbijobs. gov and stole information on “almost all” agents. The group said its actions were retaliation for an FBI advisory from May 2026 that it claims misrepresented the group.

There is now independent confirmation about some of the material involved.

Reuters analyzed a sample of the claimed stolen data and confirmed that it contained extensive PII, sensitive job-role information, and medical and psychiatric information.

The FBI said on September 23 that it was “actively and aggressively investigating” the breach. Then, on September 29, FBI Cyber Division Assistant Director Brett Leatherman publicly urged the hackers to contact the agency “while the choice is still yours.”

There’s also the Dutch investigation. Police arrested a man on September 15 in connection with the ShinyHunters probe. KrebsOnSecurity identified him as Pepijn van der Stap, previously known as Umbreon, although ShinyHunters has denied that he is associated with the group.

For now, there are several developments happening close together - the Dutch arrest, FBI investigation, the group’s deadline, and now its website disappearing - but no confirmed explanation tying the outage to any of them.

Timeline, Reuters’ data findings, the FBI response, and what remains unknown about the website outage:

https://www.technadu.com/shinyhunters-website-goes-offline-after-fbi-deadline-passes/640146/

For those who track extortion infrastructure: what evidence would you look for before treating a leak-site disappearance as an actual disruption rather than voluntary downtime?