ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
ShinyHunters claims it breached the FBI via an Oracle PeopleSoft zero-day RCE, stealing sensitive data on agents and job applicants.
ShinyHunters posted on its dark web site that it compromised FBI Criminal Justice, HR, and Medlink services and holds sensitive data on nearly all current and former agents plus job applicants. A spokesperson told The Register the group used a new pre-authenticated Oracle PeopleSoft RCE zero-day to deface FBIjobs.gov, which now shows a maintenance banner; the FBI says it is investigating the claims. The group previously weaponized the similar PeopleSoft flaw CVE-2026-35273 in June 2026 and recently hijacked Clop's ransomware leak site with an eight-figure extortion demand.
- FBI confirms it is investigating unauthorized activity affecting FBIjobs.gov.
- Group claims theft of Criminal Justice, HR, and Medlink data.
- Alleged new PeopleSoft pre-auth RCE zero-day; similar CVE-2026-35273 used in June 2026.
- Post timestamp hints at Asia-based operating timezone, per Cato Networks analyst.
- Recent playbook uses help-desk social engineering, malicious OAuth apps, stolen SaaS tokens.
Vulnerabilities mentionedAll →
- CVE-2026-352739.89%Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleToolspublished · Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component) KEV ransomware
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article668 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 23, 2026Data Breach / Cybercrime
The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency.
"We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark web site. "Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more."
The development was first reported by 404 Media. ShinyHunters said the FBI was targeted in response to a May 2026 public service announcement (PSA) that detailed the threat actor's targeting of Canvas, an online Learning Management System (LMS), while urging victims not to pay.
The attackers, in their own counter PSA, described them as "substantial false allegations," adding, "we were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to 'disrupt' our operations, an effort that ultimately proved unsuccessful."
The group has also rejected claims that it's part of The Com decentralized collective, calling it a "propaganda started by the Information Security Industry which has brainwashed past FBI and DOJ officials into formalizing this nonsense."
A ShinyHunters spokesperson told The Register that the group exploited a new Oracle PeopleSoft zero-day vulnerability to gain remote code execution and deface the FBI's jobs site with a "This site has been seized by ShinyHunters" banner. Visiting the site now reads: "Scheduled Maintenance Underway. We're Sniffing Out Site Updates for You!"
There are currently no details of a PeopleSoft pre-authenticated RCE zero-day. However, ShinyHunters weaponized a similar flaw (CVE-2026-35273) in June 2026 to break into enterprise networks and extort victims.
In a statement shared with Reuters, the FBI said it's "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."
The disclosure comes after the high-profile hacking group hijacked the dark web leak site of the Clop (aka Cl0p) ransomware crew.
"IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: [...] let's see how rich you really are," the notice read. "2.333% of my net worth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism."
"ShinyHunters; claim of an FBI breach is an unusually provocative move in the ongoing contest between law enforcement and cybercrime groups and should absolutely be taken seriously," Etay Maor, VP of threat intelligence at Cato Networks, said.
"We have seen threat actors target businesses countless times, and nation states or nation-state-connected groups have compromised law-enforcement organizations before—the 2015 OPM breach remains the most notable example—but a cybercrime brand publicly claiming an FBI compromise is different."
"One small operational clue is the September 23 timestamp on the group's post, while the news emerged on September 22 in the U.S. If that timestamp reflects the group's real operating environment, it points toward activity in Asia. It is not a definitive attribution, but it is a detail investigators will examine alongside the technical evidence."
Maor also described ShinyHunters as a resilient criminal brand that has managed to outlast takedowns, arrests, and forum seizures by evolving its methods and attracting new operators, suggesting it's more than a "fixed set of people or infrastructure."
"Its recent playbook has emphasized abusing trusted identity paths through help-desk social engineering, malicious OAuth applications, and stolen SaaS integration tokens, rather than simply breaking through a technical perimeter. That is the larger lesson here: organizations, including public-sector agencies, need to protect the identity and third-party trust relationships that attackers increasingly exploit."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.