FBI, Dropbox, and Veradigm Among Targets in September 2026 Data Breaches
A roundup of major security incidents from September 2026 reveals compromises affecting federal agencies, healthcare firms, and consumer platforms.
Key points
- The FBI was hacked by the ShinyHunters group, exposing employee and applicant personal data.
- Approximately 5,000 Dropbox accounts were compromised via unauthorized access to third-party infrastructure.
- Over 150 million driver’s licenses were exposed in a breach discovered by independent journalist Brian Krebs.
Multiple organizations suffered significant data breaches during September 2026, according to a summary published by Security Magazine. The incidents ranged from federal agency compromises to large-scale consumer data leaks involving millions of individuals. These events highlight ongoing vulnerabilities across different sectors of the technology and public service landscape.
The most notable incident involved the Federal Bureau of Investigation, which was reportedly hacked by the threat actor group ShinyHunters. The group claimed to have obtained sensitive personal information belonging to FBI employees and job applicants. This data reportedly included names, physical addresses, phone numbers, and details regarding spousal information. The exposure of such detailed personnel records raises significant privacy and security concerns for federal staff.
Healthcare and Consumer Data Exposures
Healthcare technology provider Veradigm also faced a security breach during this period. According to the report, the incident resulted from a compromise of a third-party service provider. While clinical and medical records remained secure and unaffected by the intrusion, patient Social Security Numbers were compromised. The source material also notes that more than 4 million individuals had their personal data compromised in a separate data breach, though it does not explicitly link this figure to Veradigm.
Separately, a massive leak involving driver’s licenses was brought to light by independent journalist Brian Krebs. Krebs discovered that his own license information had been exposed in the breach. The incident involved more than 150 million driver’s licenses, representing one of the largest exposures of government-issued identification data in recent months. The scale of this leak underscores the risks associated with centralized identity databases.
Cloud Storage and Third-Party Risks
Dropbox experienced a security incident affecting approximately 5,000 user accounts. The compromise occurred after an unauthorized user gained access to certain accounts through third-party infrastructure. This event illustrates the persistent risks associated with supply chain vulnerabilities and third-party integrations in cloud storage services. Users relying on connected applications may face indirect exposure when their primary service provider integrates with external systems.
These five stories, compiled by Security Magazine, represent a diverse set of threats facing organizations in September 2026. From federal law enforcement to everyday cloud users, the breaches demonstrate that no sector is immune to sophisticated cyberattacks or third-party failures. The variety of affected entities suggests that attackers are targeting both high-value government targets and large consumer databases simultaneously.
What should you do?
Security professionals should monitor for unusual activity in their environments, particularly regarding third-party integrations and access logs. Organizations should review their vendor risk management programs to ensure that partners adhere to strict security standards. Individuals should remain vigilant for signs of identity theft, especially given the exposure of Social Security Numbers and driver’s license data.
What to do and how to stay safe: FBI
- Monitor credit reports and financial statements for unauthorized activity, especially if you are a patient of Veradigm or a Dropbox user.
- Enable multi-factor authentication on all critical accounts to reduce the risk of unauthorized access via compromised credentials.
- Review third-party application permissions in your cloud storage accounts to limit exposure from external infrastructure breaches.
- Check if your driver’s license data was exposed by visiting resources provided by security researchers like Brian Krebs.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was clinical data compromised in the Veradigm breach?
No, clinical and medical information were unaffected; however, patient Social Security Numbers were compromised.
How many driver’s licenses were exposed in the breach discovered by Brian Krebs?
More than 150 million driver’s licenses were compromised in the breach.
What data did ShinyHunters claim to have stolen from the FBI?
They claimed to have obtained names, addresses, phone numbers, and spousal information of employees and applicants.
