SkynetProxy Deploy T-800

AI Lab Blog

ShinyHunters Says It Hacked the FBI. What We Can Actually Verify.

September 24, 2026

Tags: Threat Intelligence, Data Breach, Zero-Day, Extortion

ShinyHunters Says It Hacked the FBI. What We Can Actually Verify.

On Monday night, September 21, ShinyHunters told BleepingComputer it had used a brand-new zero-day in Oracle PeopleSoft to break into FBI systems. By Tuesday, the FBI’s recruitment portal - apply.fbijobs.gov - was offline, and a screenshot of the site showed where the application form used to be: “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since ‘19 ;)”.

That defacement is real. The FBI has confirmed it is investigating: “The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” As of Thursday evening, the portal still returned a service-unavailable error.

What happened next is where careful reading matters. ShinyHunters, the extortion group, claims it moved laterally from the PeopleSoft foothold into FBI-managed AWS GovCloud infrastructure and walked out with 2 to 3 terabytes of data - names, home addresses, phone numbers, dates of birth, and spouse details covering current and former FBI employees plus every applicant in the pipeline.

That full claim is unverified. BleepingComputer, which spoke to the group directly, explicitly said it could not verify the zero-day, the lateral movement, or the data volume. At publication, Oracle had not confirmed that such a flaw exists; the outlet had contacted Oracle and Google Cloud’s Mandiant team about it, and neither had responded. AWS had not commented. The FBI’s statement stops at “aware of claims… currently investigating.”

But the claim is not weightless either. 404 Media received a sample of roughly 5,000 purported FBI employee records and cross-checked them: phone numbers in the file matched the names attached, and some tied back to Department of Justice personnel. Partial verification of a sample is not confirmation of a 2-3 TB haul, but it means the group’s story is not built on thin air.

Why this one is different

Most breaches are about money or embarrassment. This one is about people - literally. A dataset of names, home addresses, phone numbers, and spouses is exactly what a foreign intelligence service needs to map a workforce, identify vulnerable recruits, and run harassment or doxxing campaigns against agents’ families. 404 Media notes that criminals in ShinyHunters’ orbit have previously used stolen phone records to track and intimidate FBI agents, and that similarly sensitive data has been shopped to foreign governments before. Whether or not the group is telling the truth about its motivation, the shape of the data fits a counter-intelligence problem better than an extortion play.

The motivation claim itself is unusual. ShinyHunters published a statement framing the attack as retaliation for a May 2026 FBI FLASH report that detailed the group, and it gave the bureau one week to correct or remove the report. The group insisted the demand was not financially motivated and was not extortion. When BleepingComputer asked whether it would release the stolen data if the FBI did not comply, the answer was “No comment.”

The precedent makes it harder to dismiss

This is not ShinyHunters’ first PeopleSoft campaign, and this is the part that separates a bold claim from a baseless one.

Between May 27 and June 9 of this year, the group exploited a confirmed zero-day - CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution flaw in PeopleSoft PeopleTools - against more than 100 organizations, two-thirds of them universities. Google’s Mandiant attributed that campaign to ShinyHunters (tracked as UNC6240), said the observed activity directly aligned with the vulnerable Environment Management Hub endpoints, and notified over 100 exposed organizations directly. Because the activity predates Oracle’s June 10 out-of-band advisory, the flaw was a true zero-day in the wild for two weeks, and it now sits in the CISA Known Exploited Vulnerabilities catalog. Nissan, Amazon’s One Medical, the Council of Europe, and Kodak were among the confirmed victims of that wave.

So the group has demonstrated, recently and verifiably, that it can find and weaponize PeopleSoft zero-days at scale. The question hanging over the FBI incident is whether the bureau was hit through a genuinely new flaw or through the June flaw in an environment that never got patched - a distinction that matters a great deal for how hard this is to fix, and for who else might be exposed. ShinyHunters says it is already using the same vulnerability against other organizations, including Fortune 500 companies.

What to watch

  • The FBI’s confirmation. Everything pivots on whether the bureau acknowledges a real breach of personnel data versus an intrusion into the jobs portal alone.
  • Oracle’s response. If a new PeopleSoft zero-day exists, every internet-facing PeopleSoft instance becomes a target overnight - the June campaign proved ShinyHunters does not sit on these. If your organization runs PeopleSoft, the Mandiant guidance from June applies now: disable or restrict the Environment Management Hub endpoints (/PSEMHUB/ and the Integration Gateway listening connector), patch, and hunt for compromise indicators rather than assuming a clean bill of health.
  • The retaliation framing. If the group is genuinely not asking for a ransom, the natural question is who the audience for the theft actually is.

The uncomfortable truth underneath all of it: the systems holding personnel data for the country’s premier law enforcement agency include internet-facing enterprise HR software, and the threat actor that hit them has a demonstrated track record with that exact software. That is the story, whether or not the terabytes check out.

Sources