ShinyHunters Says FBI Systems Were Compromised in Major Data Theft
Executive Summary
ShinyHunters claimed it compromised FBIJobs.gov on September 21, 2026, allegedly exploiting an unpatched Oracle PeopleSoft vulnerability to access additional FBI infrastructure and services, including AWS GovCloud, HR, Criminal Justice, Medlink, PEGA, and PHIRE, and exfiltrate approximately 2–3 TB of data involving FBI personnel and job applicants. The FBI confirmed unauthorized activity affecting the portal but has not verified the alleged zero-day, broader access, or data volume, while leaked samples containing personal and employment information remain unconfirmed. In its latest statement, ShinyHunters reiterated that the operation was not financially motivated, a ransom, or extortion, claimed it had achieved its objective, and said five days remained for the victim to comply with its request, without disclosing potential next steps.
Key Takeaways
- FBIJobs.gov was defaced: The FBI recruitment portal was publicly defaced on September 22, 2026, following the group's claimed intrusion.
- FBI confirmed an investigation: The FBI acknowledged unauthorized activity affecting FBIJobs.gov but has not confirmed the broader compromise claimed by ShinyHunters.
- PeopleSoft zero-day remains unverified: ShinyHunters claimed exploitation of a new Oracle PeopleSoft vulnerability enabling remote code execution. No public evidence has confirmed the alleged zero-day.
- 2–3 TB of data allegedly stolen: The group claimed to have exfiltrated approximately 2–3 TB of FBI-related information, but the claimed volume has not been independently confirmed.
- Multiple FBI services allegedly accessed: ShinyHunters claimed access to Human Resources, Criminal Justice, Medlink, PEGA, PHIRE, FBIJobs, and other services.
- Personnel and applicant data allegedly exposed: The claimed dataset reportedly includes information relating to current and former FBI employees and FBI job applicants.
- Sensitive personal information appeared in samples: Circulated samples reportedly contained names, addresses, phone numbers, employment details, and family information.
- Data authenticity remains uncertain: Some sampled records appeared consistent with real individuals, but their original source and whether they were obtained during this intrusion remain unconfirmed.
- AWS GovCloud access is unverified: The group claimed movement into additional FBI infrastructure, including AWS GovCloud, but this has not been confirmed.
- Motivation reportedly linked to retaliation: ShinyHunters stated that the operation was connected to the FBI's May 2026 advisory concerning the group rather than a conventional financial ransom demand.
- Final statement reiterates non-financial motive: ShinyHunters stated that the incident was not financially motivated, not a ransom, and not extortion, while claiming that it had achieved its objective.
- Five-day deadline remains: The group stated that five days remained for the victim entity to comply with its request but did not disclose what action would follow if the request was not met.
- Additional datasets may exist: ShinyHunters said it would not provide updates about other datasets it allegedly possesses that have not yet been publicly disclosed.
- Potential risk extends beyond the FBI: The group claimed that the same alleged PeopleSoft vulnerability was used against other organizations, including Fortune 500 companies.
- PeopleSoft environments should be reviewed: Organizations operating internet-facing PeopleSoft systems should review exposure, patch status, authentication, logging, and indicators of exploitation.
- Potential personnel impact is significant: If the exposed information is authentic and current, affected individuals could face phishing, impersonation, doxxing, harassment, identity-related fraud, or swatting attempts.
- The full attack scope remains under investigation: The actual entry point, affected systems, data source, and total volume of compromised information have not yet been established.
Attacker Profile
ShinyHunters is an English-speaking cybercriminal group associated with large-scale data theft, extortion campaigns, public disclosure of alleged stolen information, and high-profile website activity. The group has previously claimed compromises involving large organizations and educational technology environments and has engaged in public disputes surrounding victim claims and leaked data.
In this incident, the group has repeatedly stated that the operation was not financially motivated and was not a ransom or extortion campaign. It linked the activity to its dispute with the FBI and said its objective had been achieved. The group has also disputed allegations that it fabricated stolen information or deliberately harassed victims. These statements represent the group's own claims and do not independently establish the authenticity or scope of the alleged compromise.
Attack Method
ShinyHunters claimed that initial access was obtained on September 21 through an unpatched Oracle PeopleSoft vulnerability affecting a server associated with FBI recruitment services. The group claimed that the vulnerability enabled remote code execution, after which it allegedly moved into additional FBI-managed environments and services.
The group claimed access to:
- Human Resources
- Criminal Justice
- Medlink
- PEGA
- PHIRE
- FBIJobs
- AWS GovCloud infrastructure
ShinyHunters claimed that approximately 2–3 TB of information was exfiltrated, including personnel and applicant data, and that it attempted to remove evidence of its activity.
The group further claimed that some compromised services contained highly sensitive information, including employment-related records and potentially medical, prescription, or healthcare-related information associated with Medlink. These broader access and data-volume claims remain unverified.
On September 22, FBIJobs.gov was defaced with a “seized” message and associated artwork. The portal was subsequently taken offline and displayed maintenance-related messaging.
In its final statement, ShinyHunters said it had achieved its objective and that it had no further comments regarding its previously issued public statement. The group said five days remained for the victim entity to comply with its request but did not disclose what action would follow if the request was not met.
Incident Timeline
Targeted Vulnerability
The group claimed exploitation of a new, previously unknown Oracle PeopleSoft vulnerability capable of enabling remote code execution.
No public technical details currently establish the vulnerability as a genuine zero-day or confirm its exploitation against FBI infrastructure.
The claim is notable because ShinyHunters has previously been associated with PeopleSoft exploitation activity during 2026. Organizations operating exposed PeopleSoft environments should therefore review their exposure and patching status.
Targeted Country
United States
The primary target identified in the incident is the United States Federal Bureau of Investigation and its recruitment-related infrastructure.
Targeted Industry
Primary Industry:
- Federal Government
- Law Enforcement
- Government Administration
- Human Resources / Recruitment
Potentially Affected Industries:
- Financial Services
- Education
- Healthcare
- Large Enterprises
- Organizations using Oracle PeopleSoft
ShinyHunters claimed that the same alleged vulnerability had been used against other organizations, including Fortune 500 companies. These broader claims have not been independently confirmed.
Victims
Current and former FBI employees — The group claimed access to information belonging to agents, analysts, and other personnel.
FBI job applicants — Recruitment-related records were reportedly included in the allegedly stolen information.
Family members — Some circulated records reportedly contained spouse or family information.
Personnel information — Samples reportedly included names, addresses, phone numbers, employment status, assignments, email information, and family details.
Potentially sensitive professional information — The alleged dataset reportedly included job assignments and other employment-related information.
Named individuals — Samples reportedly included information associated with senior FBI personnel and other individuals. Some records appeared consistent with real people, but the original source of the information remains uncertain.
FBI institution — FBIJobs.gov was defaced and taken offline following the reported incident.
MITRE ATT&CK TTPs
The following techniques are based on the claimed attack chain and observed activity. Techniques marked claimed or inferred have not been confirmed by the FBI.
|
Technique |
MITRE ATT&CK ID |
|
Exploit Public-Facing Application |
T1190 |
|
Exploitation for Privilege Escalation |
T1068 |
|
Web Shell |
T1505.003 |
|
Web Protocols |
T1071.001 |
|
Data from Cloud Storage |
T1530 |
|
Exfiltration Over C2 Channel |
T1041 |
|
Indicator Removal |
T1070 |
|
External Defacement |
T1491.002 |
IOC
Defaced Host
apply.fbijobs[.]gov
Contact Email
Reported Onion Address
hxxps://shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd[.]onion
Mitigation Recommendations
1.Inventory internet-facing PeopleSoft systems
Identify all externally accessible PeopleSoft instances and remove unnecessary public exposure. Where possible, place systems behind a WAF, reverse proxy, or VPN.
2.Apply Oracle security updates
Ensure all applicable Oracle Critical Patch Updates are installed and prepare for emergency remediation if the alleged vulnerability is confirmed.
3.Hunt for web shells and persistence
Review PeopleSoft web directories for unexpected files, modified scripts, suspicious processes, unauthorized accounts, and unusual outbound connections.
4.Review historical logs
Examine logs from September 2026 onward for anomalous PeopleTools requests, administrative activity, authentication events, process execution, and large data transfers.
5.Segment critical systems
Isolate PeopleSoft from HR, finance, identity, and cloud environments. Restrict service-account privileges and unnecessary lateral movement.
8.Monitor cloud activity
Review AWS CloudTrail and other cloud audit logs for unusual authentication, bulk data access, new credentials, administrative activity, and abnormal data egress.
7.Strengthen egress monitoring
Alert on unusually large outbound transfers and unexpected destinations from PeopleSoft and related application servers.
8.Review third-party providers
Assess third-party services supporting recruitment, HR, medical, or administrative portals and apply equivalent security controls.
9.Protect potentially affected personnel
Provide guidance on phishing, impersonation, identity theft, doxxing, harassment, and swatting risks.
10.Monitor for secondary exposure
Monitor leak sites and other external sources for organizational information, employee records, credentials, or additional samples associated with the incident.
Conclusion
The ShinyHunters claim represents a significant reported intrusion involving FBI recruitment infrastructure, but the confirmed facts remain narrower than the group's broader claims.
The FBI has confirmed unauthorized activity affecting FBIJobs.gov and is investigating, while the portal defacement and circulated data samples provide observable elements of the incident
However, the following remain unverified:
-
- The alleged 2–3 TB data theft
- The alleged PeopleSoft zero-day
- AWS GovCloud access
- Compromise of additional FBI services
- The complete source and authenticity of the leaked dataset
- The exact intrusion path and total scope of the incident
If the exposed information is authentic and current, affected personnel could face phishing, impersonation, identity-related fraud, doxxing, harassment, and swatting risks.
In its final statement, ShinyHunters reiterated that the operation was not financially motivated, not a ransom, and not extortion, and stated that it had achieved its objective. The group said five days remained for the victim entity to comply with its request but declined to specify what action would follow if the request was not met. It also stated that it would not respond to further press inquiries or provide updates on additional undisclosed datasets.
Organizations operating Oracle PeopleSoft environments should review internet exposure, patch status, authentication controls, logging, segmentation, and data-exfiltration monitoring while the incident continues to develop.