# The Friday deadline had no sample

2026-10-01

ShinyHunters listed O’Reilly Automotive and Dexcom and set Friday as the clock. Cybernews saw no file sample. A store count is not a breach count.

Canonical: https://www.fabiocti.com/notes/the-friday-deadline-had-no-sample/
Author: Fabio Correia

Two American names went up on a new leak-site address today. Neither arrived with a file anyone else has described.

Cybernews says ShinyHunters listed O’Reilly Automotive and Dexcom and told them data would be published by end of day Friday if they did not make contact. The piece is explicit that no sample of the alleged stolen data was provided. O’Reilly’s scale, more than 6,500 stores and over 94,000 employees, is a company fact. Dexcom’s scale, products used by more than 5 million people, is a company fact. Neither number is a row count from a dump. A glucose-monitor maker’s customer base is not automatically a health-file breach because a blog said the name.

This is the same group that spent the previous fortnight in a public argument with the FBI. A new address and two logos is a publication schedule. It is not a second bureau incident, and it is not proof the auto-parts company or the device maker has lost the pile being implied.

## What Friday is for

A deadline with no sample is a request for a reply. The reply is the thing they can screenshot. Silence is not a finding that the listing is fake. A statement that “we are aware of claims” is not a finding that it is real. The work, if either name is yours or your supplier’s, is whether anything left, on a system you can check, before Friday becomes a second post.

Do not brief “5 million patients” off a product brochure. Do not brief “nothing” off the absence of a zip file on a blog. Ask for the object. If the only object is the paragraph, say that out loud, and keep the paragraph.

I have watched this group trade a countdown for a headline before. The headline is not the archive.