Cybersecurity
ShinyHunters claims FBI breach via PeopleSoft flaw
ShinyHunters said it used an unpatched Oracle PeopleSoft flaw to reach FBI systems, take employee and applicant records, and deface the FBI Jobs site, while the account remained unverified.
- ShinyHunters claimed it used a new Oracle PeopleSoft zero-day to access FBI systems on Monday night and move into FBI-managed AWS GovCloud infrastructure.
- The group said it stole between 2TB and 3TB of data, including records on current and former FBI employees, job applicants and internal services.
- BleepingComputer said it could not independently verify the alleged vulnerability, the lateral movement or the amount of data taken.
- 404 Media said it received about 5,000 purported FBI employee records and verified some details in the sample.
- ShinyHunters later said the intrusion was retaliation for an FBI FLASH report published in May 2026 and gave the bureau one week to correct or remove it.
ShinyHunters claimed the Oracle product it used allowed remote code execution, and said it used that flaw to enter FBI systems before moving into AWS GovCloud. It also said it had taken between 2TB and 3TB of data and had touched FBI Criminal Justice, HR, Medlink and other services.
The group shared a screenshot showing the FBI Jobs site altered with its branding and a message saying the site had been taken over. It said the FBI soon noticed the intrusion, shut affected systems down and that the jobs site then showed a maintenance notice.
ShinyHunters also provided two sample records that it said came from the intrusion, one said to concern an FBI special agent linked to a BreachForums investigation and another said to concern FBI Director Kash Patel. 404 Media reported earlier that it had received a sample of about 5,000 purported FBI employee records and confirmed some of the details.
In a later statement on its leak site, ShinyHunters said the attack was retaliation for an FBI FLASH report about the group published in May 2026. It gave the FBI a week to correct or remove that report, denied that the demand was extortion and would not say whether it would publish the data.
The article also said ShinyHunters had claimed it was now using the same alleged PeopleSoft flaw against other organisations, including companies in the Fortune 500. It added that the group had recently been linked to an earlier Oracle exploit and had breached Clop's leak site last week, claiming to have taken server data and Tor service keys.
Named in this story
People
- Kash Patel
- was named in one of the records ShinyHunters shared
Companies
- Oracle
- was contacted about the alleged PeopleSoft vulnerability
Organisations
- ShinyHunters
- claimed the FBI intrusion and later said it was retaliatory
- 404 Media
- first reported the alleged breach after receiving sample records
- Clop
- was the target of a later ShinyHunters leak-site attack
- The Com
- was a cybercrime community ShinyHunters denied belonging to
Governments and agencies
- FBI
- was the alleged target and was given a one-week deadline over a report
Products and systems
- PeopleSoft
- was the Oracle product ShinyHunters said it exploited
- AWS GovCloud
- was the environment ShinyHunters said it reached after the initial compromise
- Medlink
- was one of the FBI services ShinyHunters claimed to compromise
How the source tells it
The register was reportorial and sceptical, with the strongest framing coming from repeated claims of compromise and active follow-on targeting, tempered by explicit reminders that the allegations were unverified.
- alarm repeated breach and data-theft claims, reinforced by a defacement screenshot and references to sensitive employee records
- urgency claims of ongoing exploitation of other organisations and a one-week deadline to the FBI