The cybercrime extortion group ShinyHunters claims it broke into FBI computer systems late on September 21, 2026, stealing what it says is 2 to 3 terabytes of internal data. The FBI has not confirmed a breach took place. In a public statement to reporters, the bureau said only that it “is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”
ShinyHunters says it got in by exploiting an unpatched, so far unconfirmed, remote code execution flaw in Oracle PeopleSoft, the enterprise software the FBI uses to run parts of its recruitment and human resources infrastructure. The group claims the intrusion started through the bureau’s job application systems and then spread laterally into FBI-managed infrastructure hosted on Amazon Web Services’ GovCloud, a cloud region built to meet US government security requirements.
To back up the claim, ShinyHunters released a sample of roughly 5,000 records containing names, addresses, phone numbers, Social Security numbers and family details, saying it belongs to current and former FBI employees, job applicants, and other people with records in FBI systems. The sample reportedly included information the group said was tied to FBI Director Kash Patel. Reuters reported that it cross-checked some of the sample records, including Social Security numbers, against credit bureau data and previously leaked datasets, and found matches for at least ten individuals. Reuters was not able to confirm that the data actually came from FBI systems rather than some other source.
Independent outlets including BleepingComputer and 404 Media said they had not verified the existence of the PeopleSoft zero-day, the claimed lateral movement into AWS GovCloud, or the full 2 to 3 terabyte figure. 404 Media did say some of the employee details it checked matched real people, including Department of Justice personnel. As of publication, no CVE has been assigned to the vulnerability ShinyHunters describes, and Oracle has not issued a statement about it.
ShinyHunters says the attack was retaliation for a FLASH advisory the FBI published in May 2026 that detailed the group’s tactics. The group is demanding the bureau correct or withdraw that advisory within a week, and has argued the demand does not amount to extortion because it is not asking for money. As evidence of access, the group also shared what it says are screenshots of the FBIjobs.gov website defaced with its “Umbreon” logo.
This is not the first time ShinyHunters has targeted organizations running Oracle’s PeopleSoft platform. In June 2026, Oracle patched CVE-2026-35273, a critical PeopleSoft vulnerability that researchers linked to a broader campaign the group ran against companies using the software. This site has also covered ShinyHunters’ extortion campaigns against other large organizations this year, including a confirmed breach at healthcare giant McKesson that exposed 284 million patient records after the company was targeted by the same group.
Until the FBI completes its investigation or independent researchers confirm the technical details, the scale and legitimacy of this specific claim should be treated with caution. What is established is that the bureau is investigating unauthorized activity connected to its recruitment website, and that ShinyHunters has a track record of large-scale breaches against major organizations this year.
Source: BleepingComputer, with additional reporting from Security Affairs.
[…] ShinyHunters Claims FBI Breach Through Unconfirmed Oracle PeopleSoft Zero-Day […]