The ShinyHunters extortion group claimed on Tuesday that it breached FBI systems and stole data on nearly all of the bureau’s employees and job applicants.
The hackers told [404 Media] they used a zero-day in Oracle PeopleSoft on Monday night, moved into FBI-managed AWS GovCloud servers, and downloaded 2 to 3 TB of data. They also claim to have compromised FBI Criminal Justice, HR, and Medlink services.
ShinyHunters has previously exploited a PeopleSoft zero-day. According to Mandiant, the group exploited CVE-2026-35273 between May 27 and June 9, 2026, before Oracle published its advisory. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker execute code over HTTP. It is unclear whether the FBI intrusion used the same bug or a new one.
To back its claim, the group defaced apply.fbijobs.gov with a banner announcing the site had been seized, mimicking the notices the FBI posts on criminal sites it takes down. The jobs site and the Special Agent Applicant Portal remain offline.
ShinyHunters gave 404 Media a sample, which it said covers 5,000 FBI employees, with names, home addresses, phone numbers, dates of birth, and, in some cases, spouse details. 404 Media matched some phone numbers to people of the same name, and some to Justice Department personnel. Reuters found matching details in at least 10 records, including those of FBI Director Kash Patel, but could not determine where the data originated.
The FBI said it is “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” The bureau has not confirmed a breach yet.
The group says the attack is not financially motivated. On its leak site, it gave the FBI one week to correct or remove a May FLASH report stating that ShinyHunters exaggerates its access, harasses victims’ families with threatening calls and texts, and sometimes carries out swatting. The group denies those claims and any affiliation with The Com.
ShinyHunters also told BleepingComputer it is exploiting the same alleged zero-day against other organizations, including Fortune 500 companies. Oracle advises PeopleSoft customers to apply its June 2026 Critical Security Patch Update, which covers CVE-2026-35273.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
