ShinyHunters claims FBI breach via Oracle PeopleSoft; agent PII sample partially verified by 404 Media; FBI investigating
ShinyHunters (22 September 2026) claims it breached FBI systems using an alleged Oracle PeopleSoft remote-code-execution zero-day and stole employee and applicant data. The group shared a screenshot of apply.fbijobs.gov allegedly defaced with its Umbreon logo; the jobs/special-agent portals later showed maintenance.
404 Media reports receiving a sample of agent names, home addresses, and phone numbers (including spouses) and verifying a portion against public records; TechCrunch and BleepingComputer relay the claim.
BleepingComputer states it has not independently verified the alleged zero-day, lateral movement, or volume of stolen data.
UPDATE 26 Sep 2026: BleepingComputer reports the FBI confirmed it is investigating the claims without confirming a breach or data theft.
Separate Google Mandiant/GTIG report the same week documents renewed UNC6240 mass exploitation of already-patched CVE-2026-35273 (PeopleSoft PeopleTools PSEMHUB) with WAF-bypass encoding and SIDEEYE — desk tracks that campaign on card cve-2026-35273; unclear if the FBI claim is that CVE or a distinct flaw. Primary wire: BleepingComputer; corroboration: 404 Media / TechCrunch.
Switch primary_url if FBI or Oracle publishes a confirmed notice. CORRECTION (21 Oct 2026): we removed two later updates, a 30 September update quoting ShinyHunters' statements to the media and a 6 October update saying the FBI removed an Accenture contractor, because the stories they relied on were not linked or could not be read. They will return only with readable linked sources.
Correction (23 Oct 2026): removed ShinyHunters' own claims about data volume, systems reached and other targets; BleepingComputer says it has not verified them. (source: https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/)
- Product
- Alleged Oracle PeopleSoft (HR/applicant) → FBI-managed AWS GovCloud / FBI Jobs (apply.fbijobs.gov)
- Exploited in Australia?
- unknown
- Patch to
- Patch internet-facing PeopleSoft HR and applicant portals for CVE-2026-35273 and every later Oracle Critical Patch Update now, and do not rely on a WAF rule alone, since ShinyHunters is bypassing one with URL encoding. If a contractor or managed-service provider runs the platform, make patch deadlines and evidence of applied patches part of the contract and check them yourself. Keep MFA, exposure review and monitoring for PeopleSoft exploitation patterns in place, and rotate credentials if you share the same stack.