Skip to content
Today
Sections

Leadership Independently confirmed3 publishers 3 min read Published

ShinyHunters claims 2 to 3 terabytes of FBI personnel data from an Oracle PeopleSoft flaw

The bureau has not confirmed a breach and says it cannot yet tell whether its own systems or a third-party provider were the way in, while Reuters and 404 Media report that sample records match real personnel.

The Board Room · Leadership desk

Send a correction

What happened

  • ShinyHunters said in dark web posts and exchanges with media outlets that it took 2 to 3 terabytes of data on FBI and Justice Department workers, covering both employees and job applicants.
  • The group said it got in through a new vulnerability in Oracle PeopleSoft, a human resources application, and listed criminal justice, human resources and Medlink among the affected services.
  • The FBI has not confirmed a breach, saying on Tuesday that it is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is investigating.
  • Reuters said it partially verified a sample it was shown against social security numbers, credit bureau records and previously breached data, including information on FBI director Kash Patel.
  • The FBI jobs site was defaced with a message claiming ShinyHunters had seized it, in the style of an FBI seizure notice, and now tells visitors it is down for maintenance.

Why it matters

  • Who's exposed exposure Addresses, dates of birth and spouse details on people whose employer is a federal law enforcement agency are useful for targeting, and that usefulness survives a password reset.
  • What it limits constraint With the entry point undetermined between the bureau's own enterprise and a third-party provider, anyone running the same suite is still guessing whether to patch an install or interrogate a vendor.
  • What it sets up precedent Two PeopleSoft flaws tied to one group inside a year puts HR platforms in the same review tier as finance and customer systems for organisations that run the suite.
  • Who has to decide decision The FBI tells victims not to pay or engage, and the demand here is a correction to an FBI report, so the victim is working from guidance aimed at payment demands.

PC Gamer reported that the sample ShinyHunters gave 404 Media appears to contain the personal data of 5,000 FBI employees [18], and that 404 found it includes addresses, phone numbers, dates of birth and "in some cases details on their spouse" [19]. An applicant file is the most complete record an organisation holds on a person before they are hired. CBS News reported that neither Reuters nor 404 Media has established that the records came from FBI systems [5].

ShinyHunters says the vulnerability it used is new [24]. That is the weakest-supported part of the claim, and the part that matters to other PeopleSoft customers. FBI documents confirm that the bureau's recruiting arm uses PeopleSoft and AWS GovCloud [17]. CBS News called a new software flaw, a breach of FBI systems and large-scale data theft plausible, while saying it has not verified the group's claims [16].

An Internet Crime Complaint Center advisory in May 2026 cautioned that actors using the ShinyHunters name may make real or exaggerated claims of access, threaten victims and their relatives and engage in swatting [10]. Earlier the same month, a May 8 FLASH bulletin warned about stolen credentials and the abuse of trusted vendor and cloud relationships [9]. On Wednesday the bureau said "the point of breach is still undetermined" and that it is "working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk" [15].

PeopleSoft has come up twice in a year of this group's activity. Google documented ShinyHunters exploiting a different PeopleSoft zero-day from May 25 through June 9, a stretch of 16 days [21][22]. Add the flaw claimed this week and two separate PeopleSoft vulnerabilities are tied to the group in 2026, one documented by an outside researcher and one asserted by the attacker [23].

What ShinyHunters wants is a correction to an FBI report. A post addressed to FBI Director Kash Patel and Cyber Division Assistant Director Brett Leatherman said "We have compromised the FBI." [3] The group gave the bureau one week to "correct or remove" portions of the FLASH report it disputes [12]. Its representative told 404 Media that what it planned was "not something I'd call extortion, maybe coercion" [14], while CBS News reported that the group's post rejected descriptions of its actions as ransom, coercion or extortion [13]. In both May warnings the FBI advised organisations not to pay or engage with the demands [11].

FBIjobs.gov has been the primary place to apply for agent and support positions since 2017 [20], so the exposed population, if the claim holds, reaches well beyond current staff. Sources told ABC News that the FBI is still assessing the extent of the breach and what information may have been compromised, and that it is unclear how many people might be impacted [8].

What to watch

  • Whether Oracle confirms or patches a new PeopleSoft vulnerability; CBS News said it has asked the company for comment.
  • Whether the FBI's investigation places the entry point in its own enterprise or with a third-party provider supporting FBIJobs.gov.
  • What the group does when its one-week deadline for the FBI to correct the FLASH report runs out.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption45
Hype gap+30
Incentives80
Confidence60

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 63%
Investor
Investor 15%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    ShinyHunters claimed in communications posted on the dark web and in exchanges with multiple media outlets that it stole 2 to 3 terabytes of data related to FBI and Justice Department workers, including personnel and job applicants.

    Reported SupportedView cited source
  2. [2]

    ShinyHunters listed criminal justice, human resources and Medlink systems among the services that were affected.

    Reported SupportedView cited source
  3. [3]

    On Tuesday, ShinyHunters claimed in a post addressed to FBI Director Kash Patel and FBI Cyber Division Assistant Director Brett Leatherman: "We have compromised the FBI."

    Reported SupportedView cited source
  4. [4]

    The FBI has not confirmed the breach, but said Tuesday it was aware "of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."

    Reported SupportedView cited source
  5. [5]

    Reuters and 404 Media reported that portions of data supplied by the hackers correspond to real FBI or Justice Department personnel, though neither has established that the records came from FBI systems; CBS News has not independently verified these findings.

    Reported SupportedView cited source
  6. [6]

    Reuters was shown a data sample by the group and says it was able to partially verify the information by running the details against existing social security numbers, credit bureau records and previously breached data, including information on current FBI director Kash Patel.

    Reported SupportedView cited source
  7. [7]

    The FBI jobs website was defaced as part of the hack with a message that said "this site has been seized by ShinyHunters", mimicking the notice commonly seen on seized cybercriminal pages; the site currently informs users it is "down for maintenance."

    Reported SupportedView cited source
  8. [8]

    The FBI is continuing to assess the extent of the breach and what information may have been compromised, according to sources familiar with the matter, and it is unclear how many people might be impacted.

    Reported SupportedView cited source
  9. [9]

    A May 8, 2026 FBI FLASH bulletin described what it called the ShinyHunters ecosystem, warning of stolen credentials, abuse of trusted vendor and cloud relationships, plus data theft and extortion sometimes involving harassment.

    Reported SupportedView cited source
  10. [10]

    A week after the May 8 bulletin, an Internet Crime Complaint Center advisory cautioned that actors using the ShinyHunters name may make real or exaggerated claims of access, threaten victims and relatives, engage in swatting and falsely allege they hold compromising material in order to pressure targets.

    Reported SupportedView cited source
  11. [11]

    In both May 2026 warnings, the FBI advised organizations not to pay or engage with the group's demands.

    Reported SupportedView cited source
  12. [12]

    The group gave the FBI a deadline of one week to "correct or remove" portions of the earlier FLASH report.

    Reported SupportedView cited source
  13. [13]

    ShinyHunters' post disputed the FBI's description of the group, denying that its demands are financially motivated and rejecting descriptions of its actions as ransom, coercion or extortion.

    Reported SupportedView cited source
  14. [14]

    A ShinyHunters representative told 404 Media the attack was not financially motivated and that what they plan to do with the information is "not something I'd call extortion, maybe coercion."

    Reported SupportedView cited source
  15. [15]

    In a Wednesday statement the FBI said "the point of breach is still undetermined", whether a third party or the FBI's enterprise, and that it is "working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk."

    Reported SupportedView cited source
  16. [16]

    CBS News reported that the new software vulnerability, breach of the FBI's systems and large-scale data theft are plausible, though ShinyHunters' claims have not yet been verified by CBS News.

    Reported SupportedView cited source
  17. [17]

    FBI documents confirm that the agency's recruiting arm uses PeopleSoft and AWS GovCloud.

    Reported SupportedView cited source
  18. [18]

    A sample provided by the group to 404 Media appears to contain the personal data of 5,000 FBI employees.

    Reported SupportedView cited source
  19. [19]

    According to 404 Media, the data includes addresses, phone numbers, dates of birth, and "in some cases details on their spouse."

    Reported SupportedView cited source
  20. [20]

    Since 2017, FBIjobs.gov has been the primary place for job seekers to apply for employment at the FBI for agent and other support positions.

    Reported SupportedView cited source
  21. [21]

    From May 25 through June 9, Google documented ShinyHunters exploiting a different Oracle PeopleSoft zero-day vulnerability.

    Reported SupportedView cited source
  22. [22]

    Google's documented window of ShinyHunters exploiting an earlier PeopleSoft zero-day, May 25 through June 9, spans 16 days inclusive.

    Derived Supported
  23. [23]

    Two distinct Oracle PeopleSoft vulnerabilities have been tied to ShinyHunters activity in 2026: the zero-day Google documented in May and June, and the new flaw the group claims it used against the FBI.

    Derived Supported
  24. [24]

    The hackers claim to have used a new vulnerability with Oracle PeopleSoft, a human resources management program.

    Reported ContestedView cited source
  25. [25]

    CBS News has reached out to Oracle for comment.

    Reported ContestedView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. abcnews.com

    1 article · September 22, 2026

    FBI investigating possible cyber breach of its job application website: Sources - ABC News
  2. cbsnews.com

    1 article · September 23, 2026

    Cybercriminal group claims it stole FBI personnel and applicant data - CBS News
  3. pcgamer.com

    1 article · September 23, 2026

    'We hacked the FBI' says previous Rockstar-breaching hacking group: 'We hold data on all FBI employees and applicants' | PC Gamer

Topics and entities

Topics

Entities