Sep 22: Cl0p Extorted, CrowdSec Source Code, BigCommerce

ShinyHunters escalated its takeover of Cl0p’s dark web site into a direct extortion campaign over the weekend, setting an eight-figure ransom demand and threatening to release records identifying every organization that paid Cl0p a ransom. Cl0p responded by Monday, per The Record.

The demand was framed as “2.333% of Cl0p’s purported net worth,” implying a belief that the ransomware operation holds hundreds of millions in assets. Within 24 hours it expanded to include a public apology and a share of proceeds from Cl0p’s Oracle E-Business Suite campaign. ShinyHunters posted on the hijacked site: “Clock is ticking moron. Kindly excuse our unprofessionalism.”

The leverage: records claimed to identify which organizations paid Cl0p, the amounts paid, and associated Bitcoin addresses. Authenticity of those records: unconfirmed. Cl0p’s move to establish contact: confirmed.

Analysis: any organization that previously paid Cl0p is now a potential target for a second extortion from a different actor, if ShinyHunters holds what it claims. That is not a patch situation. It is a legal review and incident disclosure review situation. Watch for updates.

Background on the initial site takeover: ShinyHunters Breaches Clop Tor Site, Steals Onion Keys. Story continuing.

Supply chain: CrowdSec source code confirmed stolen

CrowdSec confirmed this week that source code was exfiltrated during the May 2026 TanStack JavaScript supply chain compromise. The disclosure covers what was taken. No vulnerability has been identified in the stolen code yet. Full coverage.

Current operational risk for CrowdSec deployments: low. The platform’s detection logic runs on community-shared behavioral rules, not a binary that could be silently tampered with. The exposure is that attackers can now audit the code offline for unknown flaws, study detection patterns for evasion, and look for any secrets that moved through the repository.

Action: watch CrowdSec’s advisory channel. When a signed release or key rotation guidance comes out, apply it. Nothing to do before that point.

The TanStack compromise continues to surface confirmed downstream victims. This is the second major security-adjacent disclosure tied to that event in two days, following Jade Sleet’s compromise of an Indian IT services provider.

BigCommerce: merchant PII accessed via Ribon app credentials

BigCommerce notified merchants of a breach affecting customer data after attackers compromised credentials for third-party Ribon applications integrated with merchant storefronts. Attack window: September 13 through September 17. BigCommerce removed the affected apps on September 17, per BleepingComputer.

Exposed data per confirmed disclosure: names, email addresses, phone numbers, shipping postal addresses. Payment card data and account passwords: confirmed not exposed, stored separately.

Scope is uncertain. BigCommerce described “a small number” of merchants affected. Master of Malt, one confirmed victim, estimated the breach could extend to “hundreds of other stores.” That figure is unverified. A law firm is seeking claimants. The UK ICO was notified.

No CVEs or specific technical indicators have been disclosed. This was credential compromise and API access, not a platform vulnerability in BigCommerce’s own code.

Also since yesterday

• CVE-2026-94185 (nvm, CVSS 5.5, GHSA-8grh-q73j-ffrc): Path traversal in nvm alias resolution, fixed in 0.40.8. Standard single-user installs: lower exposure. Shared build environments and CI pipelines: higher. Coverage.