The crew got the headline. Who got the night shift?

On 22 September 2026 the extortion crew ShinyHunters said it had taken between 2 and 3 terabytes from FBI systems through an unpatched flaw in Oracle PeopleSoft, and put its own logo on the bureau’s recruitment site to prove the point. BleepingComputer reported the claim the same day. The FBI said it was aware of claims regarding unauthorised activity affecting FBIjobs.gov and was investigating. It confirmed nothing.

Within hours the crew’s name was everywhere. It had been there three days earlier too, after the same group defaced the Clop ransomware gang’s leak site, which is a strange sentence to write and was widely enjoyed.

Now think about the other side of that morning. Every organisation running PeopleSoft, and there are thousands of them across universities, councils, health services and large employers, had the same short list of questions and no published vulnerability identifier to look them up with. Somebody had to find every instance, including the pre-production copy stood up for a migration in 2023 and never switched off. Somebody had to read a month of authentication logs. Somebody had to sit in front of an executive at 8am and say, honestly, that they did not know yet.

Nobody wrote that down. There is no byline on a quiet Tuesday that stayed quiet.

The claim was built to be loud

There is a detail in this story that makes the defenders’ job harder, and it comes from the FBI itself. A FLASH report published in May 2026 warned that this group may exaggerate the access it holds, harass victims and their relatives, carry out swatting attacks, and falsely claim to possess compromising material. The crew says this hack is retaliation for that report.

So the organisation best placed to describe the group had already said, on the record, that its claims run hot. And the claim now on the table is the largest it has made.

A defender reading that headline has to work in the gap. The number may be inflated. The technique may be entirely real. Waiting to find out which is not available as a plan. What follows is triage under deliberate uncertainty, and it is a specific professional skill that almost nobody outside the room can see: deciding what to check first when the information you have was written by someone with an interest in frightening you.

What the night shift actually looks like

Strip away the drama and the work is procedural, tedious and consequential.

• An engineer inventories every instance of the affected software, then goes looking for the ones missing from the inventory, because those are the ones that will be reachable.
• An analyst pulls thirty days of authentication logs and reads them, looking for a successful login from an address nobody recognises and an administrative account created outside the change process.
• Somebody maps the blast radius: what that server trusts, what trusts it, which cloud role it can assume, which databases it queries.
• A team lead decides what to tell the board before the facts are in, and how to say it without either panic or false comfort.
• A support engineer answers the same question forty times from colleagues who read the news and are frightened, and answers it patiently the fortieth time.

Each of those is a judgement call made at speed with incomplete information. That last one is a skill too, and it never appears in a job description.

The recruitment portal tells you something about attention

Note which system carried the defacement. Not a case management platform. The jobs site.

Every organisation that hires keeps a database of people who wanted to work there: national insurance numbers, home addresses, dates of birth, right-to-work documents, referees at other organisations, salary history. Most of those people never became employees. They applied once, years ago.

That system is rarely anyone’s priority. It does not process payments. It does not touch the product. It gets the security attention left over after the systems that carry revenue have taken theirs, which is to say very little. The person who argues, in a planning meeting, that the applicant database deserves the same protection as the finance system is doing something genuinely difficult, and is usually doing it alone. They will not be thanked for it this year. They may be proved right in a way nobody enjoys.

Naming the work is the only correction available

The field cannot make quiet work loud. What it can do is name the people who did it, on the record, judged by peers who understand what the work involved.

That is the whole reason this programme exists, and the reason nominations here cannot be bought. Every nomination is read in full by at least two panellists before a single score is given. Categories are not sponsored. A marketing budget moves nothing. The panel scores against published criteria, and the evidence that scores well is specific: what the situation was, what this person decided, what changed because they decided it.

A nomination that says a team worked incredibly hard during a difficult week will score poorly. One that says an engineer found an exposed instance on the second night, took it off the internet before anyone reached it, and then rebuilt the inventory process so it could not happen again, will not.

Who was working that night

Somewhere in your organisation there is a person who spent this week answering a question raised by somebody else’s headline. They did not choose the timing. They will not post about it. When the week is over they will go back to the work that was already late before the news broke.

They are not going to nominate themselves. That part is on you.

Put someone forward, or read what each category honours before you do.

Sources

• BleepingComputer, ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach, 22 September 2026.
• BleepingComputer, ShinyHunters hacks Clop leak site, threatens to extort ransomware gang, 19 September 2026.
• Information Commissioner’s Office, Personal data breaches: a guide.