Cyber Advisory Briefing - September 2026

A Data Breach Is More Than an ICO Fine

What the Alleged Compromise of the FBI Jobs Portal Can Teach Organisations About the Real Impact of a Data Breach

Cyber security headlines often focus on the initial incident.

Which system was compromised? How many records were exposed? Who was responsible?

While these questions are important, they often distract from a more important issue:

What happens after the breach?

Recent reporting concerning the alleged compromise of the FBI Jobs portal provides a useful reminder that the consequences of a cyber incident can extend far beyond regulatory reporting requirements, financial losses and media coverage.

The incident has been linked in public reporting to the cybercriminal group ShinyHunters, a threat actor associated with a number of high-profile data theft incidents in recent years.

Whilst investigations remain ongoing and many details have yet to be confirmed, the wider lessons are relevant to organisations of every size.

Because a data breach is rarely just about the data that was stolen.

It is about the consequences that follow.

The Unusual Twist

One aspect of the story received particular attention.

BBC cyber correspondent Joe Tidy reported that individuals claiming to be connected to the attack disputed how the incident was being portrayed and suggested that the breach was not financially motivated. They also reportedly claimed they did not intend to publish or sell the information.

From a cyber security perspective, these claims are certainly interesting.

From a risk management perspective, however, they change very little.

Once information has been copied and removed from an organisation's control, the organisation can no longer rely on the intentions, promises or assurances of the people who have obtained it.

The reality is simple.

The organisation has lost control of the data.

Whether information is leaked, sold, retained, shared or simply stored for future use is often outside the victim's control.

That uncertainty is frequently one of the most difficult aspects of managing a cyber incident.

Why This Breach Is Different

Most organisations immediately associate data breaches with fraud and financial crime.

The alleged compromise of the FBI Jobs portal highlights a broader concern.

Where sensitive personal information, employee records and potentially operationally sensitive information are involved, the consequences can extend far beyond financial loss.

For affected individuals, exposed information may create:

• Personal security concerns

• Increased targeting by threat actors

• Privacy risks

• Identity fraud risks

• Long-term uncertainty regarding future misuse of data

The true impact of a breach is often determined not by how many records were exposed, but by the nature of the information involved.

Who Are ShinyHunters?

ShinyHunters is a cybercriminal collective that has been linked through public reporting to a number of high-profile breaches affecting organisations including Ticketmaster, Santander and AT&T.

The group has become known for targeting valuable personal and commercial information.

Whilst attribution in cyber incidents is rarely straightforward, the group's name has repeatedly appeared in reporting surrounding significant data theft events.

The important business lesson is not necessarily who carried out an attack.

It is understanding what can happen after information has been stolen.

From Breached Records to Future Fraud

Most stolen information does not exist in isolation.

An email address, telephone number or job title may appear relatively harmless when viewed on its own.

However, when combined with information from previous breaches, social media profiles, supplier records or publicly available information, even limited datasets can become highly valuable.

This information can be used to support:

• Phishing campaigns

• Business Email Compromise (BEC)

• Social engineering attacks

• Payment diversion fraud

• Identity theft

• Credential theft attempts

One of the most important lessons from incidents like this is that stolen information often becomes more valuable over time.

Information that appears insignificant today may become a critical piece of a larger fraud campaign tomorrow.

Why SMEs Should Care

One of the most common cyber security myths is that attackers only target large organisations.

In reality, many attackers are far more interested in the value of the information than the size of the organisation holding it.

Small and medium-sized businesses frequently possess:

• Customer information

• Employee records

• Supplier data

• Commercial contracts

• Intellectual property

• Financial information

All of which may be attractive to cybercriminals.

The question is not whether an organisation is important enough to be targeted.

The question is:

What information do we hold that would cause the greatest damage if it were exposed?

For many organisations, answering that question provides a strong starting point for improving cyber resilience.

Three Practical Actions Organisations Should Take

1. Understand Your Critical Information Assets

Know what information you hold, where it is stored and who has access to it.

Not all data carries the same level of risk.

Understanding which information is most sensitive allows organisations to prioritise security efforts more effectively.

2. Plan Your Response Before an Incident Occurs

Successful incident response rarely happens by accident.

Organisations should understand:

• Who leads the response

• Who communicates with customers and stakeholders

• When legal and regulatory advice is required

• How evidence will be preserved

Making these decisions during an incident is significantly harder than making them beforehand.

3. Reduce the Risk of Follow-On Attacks

Many breaches are followed by phishing attempts, fraud campaigns and further attacks.

Practical controls such as:

• Multi-factor authentication

• Timely patching

• Security awareness training

• Supplier risk management

• Strong password policies

continue to provide significant value.

Final Thoughts

The alleged compromise of the FBI Jobs portal may be an extreme example, but it highlights a lesson that applies to organisations of every size.

Cyber security is not simply about preventing incidents.

It is about understanding and managing the consequences when incidents occur.

The most difficult aspect of many cyber incidents is not what is known.

It is what remains unknown.

Will the information be sold?

Will it be published?

Will it be combined with other data?

Will it be used in future fraud campaigns?

Often, nobody knows.

And that uncertainty is precisely why organisations should focus not only on prevention, but on resilience.

Because when a breach occurs, the real damage often comes later.

And once data leaves your control, its future is no longer yours to decide.

Rob Goddard
Director | Praxium Cyber

Helping organisations understand risk, improve resilience and become cyber-insurance ready.