Cybersecurity
ShinyHunters claims FBI services breach and data theft
A representative of ShinyHunters said the group used an Oracle PeopleSoft zero-day to reach FBI-related systems, take employee and applicant data, and deface the FBI jobs site.
- A representative of ShinyHunters told 404 Media that the group had breached multiple FBI-related services and held data on FBI employees and applicants.
- The representative said a sample contained about 5,000 FBI employees’ names, home addresses, phone numbers, dates of birth and some spouse details.
- 404 Media checked some sample phone numbers with OSINT Industries and Darkside and found matches to people with the same names, including some U.S. Department of Justice personnel.
- ShinyHunters said it used a zero-day in Oracle’s PeopleSoft product, then accessed AWS GovCloud servers and downloaded between two and three terabytes of data.
- The group also defaced the FBI jobs website, and the FBI did not immediately respond to a request for comment.
A representative of ShinyHunters told 404 Media that the group had breached multiple FBI-related services and taken data on FBI employees and applicants. The representative said the material included names, home addresses, phone numbers and spouse information.
The group gave 404 Media a sample that appeared to contain data on about 5,000 employees. 404 Media checked some of the phone numbers against OSINT Industries and Darkside, a tool made by District 4, and found matches to people with the same names and to some U.S. Department of Justice personnel.
ShinyHunters also defaced the FBI jobs website on Tuesday. The site later said Apply.fbijobs.gov and the Special Agent Applicant Portal were unavailable.
The representative said the group had used a zero-day exploit in Oracle’s PeopleSoft product and then reached AWS GovCloud servers. The same source said the exfiltrated data totalled between two and three terabytes.
When asked whether the group would try to extort the FBI, the representative said it would not be extortion and said the action was not financially motivated. The FBI did not immediately respond to a request for comment.
Named in this story
Companies
- Oracle
- was named as the vendor of the PeopleSoft product said to be exploited
- District 4
- made the Darkside tool
Organisations
- ShinyHunters
- claimed the breach, theft and defacement
Governments and agencies
- FBI
- was the target of the claimed intrusion and had not commented
- U.S. Department of Justice
- was linked to some of the phone numbers in the sample
Products and systems
- PeopleSoft
- was the Oracle product the group said it used a zero-day against
- AWS GovCloud
- was the cloud environment the group said it reached after the exploit
- OSINT Industries
- was used by 404 Media to check sample phone numbers
- Darkside
- was used by 404 Media to search some of the records
- Apply.fbijobs.gov
- was one of the FBI job sites reported unavailable
- Special Agent Applicant Portal
- was reported unavailable after the defacement
How the source tells it
The piece is strongly framed, mixing alarmist speculation about consequences with mocking asides about the group’s claimed hack.
- alarm worst-case national-security and safety consequences were laid out from a claimed breach without evidence they had occurred
- speculation presented as fact possible foreign-intelligence use and future harm were described in declarative terms rather than attributed analysis
- derision the defacement and announcement were presented with repeated mocking references to seizure notices and the administration