ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
ShinyHunters claims it breached the FBI via an Oracle PeopleSoft zero-day RCE, stealing sensitive data on agents and job applicants.
ShinyHunters posted on its dark web site that it compromised FBI Criminal Justice, HR, and Medlink services and holds sensitive data on nearly all current and former agents plus job applicants. A spokesperson told The Register the group used a new pre-authenticated Oracle PeopleSoft RCE zero-day to deface FBIjobs.gov, which now shows a maintenance banner; the FBI says it is investigating the claims. The group previously weaponized the similar PeopleSoft flaw CVE-2026-35273 in June 2026 and recently hijacked Clop's ransomware leak site with an eight-figure extortion demand.
- FBI confirms it is investigating unauthorized activity affecting FBIjobs.gov.
- Group claims theft of Criminal Justice, HR, and Medlink data.
- Alleged new PeopleSoft pre-auth RCE zero-day; similar CVE-2026-35273 used in June 2026.
- Post timestamp hints at Asia-based operating timezone, per Cato Networks analyst.
- Recent playbook uses help-desk social engineering, malicious OAuth apps, stolen SaaS tokens.
- CVEs
- CVE-2026-35273
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1491.002 External DefacementT1550.001 Application Access TokenT1078 Valid Accounts
- Threat actors
- ShinyHuntersClop
- Organizations
- Federal Bureau of InvestigationOracleCato Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
From the original article
3 min read at thehackernews.com
The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U. S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.