I was offered my first outside job after the second year of highschool, I kinda accidentally interviewed for a at the time respected gamedev firm (since I was looking for a summerjob heh) and when we started talking about when to start and I mentioned my school semesters the interviewer realized that I was younger than he had assumed.
I think it turned out to be mostly one guy, but he wasn't a teenager, anymore, when they finally got him[0]. I know that after that arrest, the group disappeared.
I think that some of the kids they are nailing for ShinyHunters actually ordered hits.
Maybe publicly going after the FBI wasn't such a bright move... They could have kept it quiet, and made millions, selling to bad guys.
[0] https://www.csoonline.com/article/510783/data-protection-flu...
They're trolling him saying he's not nearly as good and tarnishing the ShinyHunters rep.
I have no idea what's true, but they can all go to hell.
Outside of a few cases, it's always been a box checking exercise. If you're fortunate, the boxes are kept up to date / written by somebody that knows what they're doing. If you're like most, the box hasn't changed since the 90s when "complex passwords, changed quarterly" was in vogue.