The leak site changed hands

The blog you monitor is not a library. It is a server someone else can take.

BleepingComputer confirmed over the weekend that ShinyHunters uploaded a text file to Cl0p’s Tor leak site, then replaced the page with their own mark. They say the door was an unauthenticated Grav CMS upload. Independently verified: the file was fetchable from Cl0p’s onion, and the defacement was live. Not independently verified: source, /var/log, or the onion private keys they say they now hold.

By Monday Cl0p was posting on the hijacked page asking ShinyHunters to come online because the email did not work. The Record reports the new demand includes records of which companies paid Cl0p on the Oracle E-Business Suite campaign, how much, and which Bitcoin addresses.

Why counsel will misread this

A leak-site listing is already a claim. This week the publisher is also a claim. Screenshots from Friday may be Cl0p. Screenshots from Saturday may be ShinyHunters sitting in Cl0p’s URL. If the keys are real, kicking them off the host does not retire the address.

The earlier note on this pattern was: get the dump, not the blog post. The extra failure mode is that the blog post is now a gang-war channel. “We were named” can mean you were named by Cl0p, named in a defacement, or about to be named as a payer. Those are three different facts. Only one of them is a disclosure event you already knew about.

What to do with a Cl0p URL this week

Keep the listing you already archived, with date and hash. Do not refresh it from the live onion and call that the same source. Treat any new “who paid” table as an allegation until a payment you actually made matches an amount and an address you control. Commodity names on a rival’s page are not proof you wired anyone.

If you paid Cl0p in that Oracle window, the useful question is not whether ShinyHunters is bluffing. It is whether the receipt they threaten to publish is yours, and whether that fact is already in a regulator file. If you did not pay, a screenshot of their feud is not your incident.

I still do not treat a leak blog as the incident. This week I also do not treat the blog as Cl0p.