The ShinyHunters extortion group claims it breached FBI systems by exploiting a previously unknown remote-code-execution vulnerability in Oracle PeopleSoft. The group says it moved into FBI-managed AWS GovCloud infrastructure, accessed internal services, and stole between 2 TB and 3 TB of data involving FBI employees and job applicants. It claims to have accessed Criminal Justice, HR, and Medlink services, and says it is using the same alleged flaw against other organizations.
The FBI Jobs website was defaced with a ShinyHunters message, and the group shared sample records that it said came from the intrusion. A separate report said a sample contained about 5,000 purported employee records and that some details appeared accurate. However, BleepingComputer has not independently verified the zero-day, the lateral movement, the stolen-data volume, or the authenticity of the samples. The FBI reportedly took affected systems offline, while Oracle and Mandiant were contacted for comment.
https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/
oxhak / Ox HaK
npub1sx…dz7z7
2026-09-22 20:07:08 UTC
Author Public Key
npub1sxexewvzysc3affq4yzzh7w8e3udyujap2vlj7t6lkdg5dvhp24q4dz7z7Published at
2026-09-22 20:07:08 UTCEvent JSON
{
"id": "f8c489f55dbd1d8694ae4ebd262b20d71093fad28453dea71845ea5ad7e904ad",
"pubkey": "81b26cb98224311ea520a9042bf9c7cc78d2725d0a99f9797afd9a8a35970aaa",
"created_at": 1790107628,
"kind": 1,
"tags": [],
"content": "The ShinyHunters extortion group claims it breached FBI systems by exploiting a previously unknown remote-code-execution vulnerability in Oracle PeopleSoft. The group says it moved into FBI-managed AWS GovCloud infrastructure, accessed internal services, and stole between 2 TB and 3 TB of data involving FBI employees and job applicants. It claims to have accessed Criminal Justice, HR, and Medlink services, and says it is using the same alleged flaw against other organizations.\n\nThe FBI Jobs website was defaced with a ShinyHunters message, and the group shared sample records that it said came from the intrusion. A separate report said a sample contained about 5,000 purported employee records and that some details appeared accurate. However, BleepingComputer has not independently verified the zero-day, the lateral movement, the stolen-data volume, or the authenticity of the samples. The FBI reportedly took affected systems offline, while Oracle and Mandiant were contacted for comment.\n\nhttps://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/",
"sig": "556b1de59cd87727903fb993e098115d12b53f4ca9aade25e71b36b6b9226af752e809468d3ef5b512c50a81796dad248cd8beb64f9022b63bf8ed8ddfef2212"
}