The FBI has confirmed that its recruitment portal, fbijobs.gov, was compromised in September 2026. The ShinyHunters extortion group claimed the attack. On October 6, FBI Cyber Division Assistant Director Brett Leatherman said the breach came from "a security failure of a platform managed by a third-party organization" after a contractor failed to apply a patch that had been issued specifically to secure that platform. Reuters sources, cited by SecurityWeek, say the platform was Oracle PeopleSoft and the contractor was Accenture. The FBI has not named either. ShinyHunters told NBC News it stole 2 to 3 TB of data, and NBC could not verify that figure. Estimates of who was exposed range from "thousands" of employees (Reuters, via SecurityWeek) to the bureau's "entire workforce" (BBC). Several arrests have followed. The aggregator QPulse names one of the people arrested as ransomware negotiator Edward Dubrovsky. We could not confirm that name in the primary or established-press sources we reviewed.
What Happened
ShinyHunters announced the hack on September 22, 2026, on its dark web leak site. It claimed "sensitive data on almost all FBI agents and individuals who filed an application with the FBI for a job" (TechCrunch). The jobs site was defaced and taken offline, and so was the special agent applicant portal. On September 23 the FBI acknowledged the claims in a formal statement. At that point it said the point of breach was "still undetermined, whether a third-party or the FBI's enterprise." By October 6, its internal review had blamed the contractor's missed patch, and the bureau said it had "removed the contractor." Accenture did not address the allegation and said only that it was "proud to support the mission of the FBI."
The group said the attack was "not financially motivated." Its stated demand was that the FBI correct or remove a May 2026 report that ShinyHunters says contains false allegations about it (TechCrunch, SecurityWeek). The BBC reported that the group set a four-day deadline before it would publish the stolen databases.
Arrests. Accounts of the arrests vary in how detailed they are and how well they are sourced: - September 15, 2026: FBI Director Kash Patel announced that Dutch National Police had arrested "one of the alleged leaders of ShinyHunters" (NBC News). This was a week before the FBI breach was claimed. QPulse names the suspect as Pepijn van der Stap, a previously convicted hacker. That name does not appear in the other sources we reviewed. - September 29, 2026: QPulse alone reports that a 17-year-old known as "Rey" was detained in Jordan. This is unconfirmed. - October 9, 2026: AP reported that the FBI had arrested a co-conspirator in the jobs-site breach. QPulse identifies this person as Edward Dubrovsky, 54, a Canadian cybersecurity executive and former managing director at incident response firm Cypfer, and says he was charged with conspiracy to extort and interference with commerce. The AP excerpt we have does not include the suspect's name, so treat the Dubrovsky identification and charges as reported by a single aggregator until court filings or primary outlets confirm them.
QPulse also reports that ShinyHunters ran an extortion site, shinywire[.]com, from May 3 to October 16, 2026. It says the site listed nearly 100 victims, including Intuitive Surgical, and that the group has extorted more than $70 million since 2019. No other source in this set corroborates those figures.
What Was Taken
Sources differ on how much data was taken and what it included: - Volume: ShinyHunters told 404 Media it took "terabytes" of data (via TechCrunch) and told NBC News it took "between 2 and 3 terabytes." Neither outlet independently verified the volume. - Verified data types: 404 Media received a sample containing names, home addresses and phone numbers of FBI agents and their spouses. It checked part of the sample against public records (via TechCrunch). - Claimed data types: QPulse lists Social Security numbers, medical and psychological records, and details of employees' units and specializations. Established outlets have not confirmed these categories, though the BBC says some of the material was leaked to the media. - Population: The FBI's own statement refers only to "alleged impact to FBI employee PII." Reuters (via SecurityWeek) says thousands of employees were affected. The BBC says the breach "appears to have exposed" the whole workforce. The attackers say the data covers job applicants as well as staff.
Why It Matters
This data is about the people who work in counterintelligence and law enforcement. Current and former agents told the BBC they fear for undercover personnel and expect targeted phishing, bribery attempts, swatting and "violence-as-a-service" attacks from young online gangs that the bureau has investigated. TechCrunch notes that foreign intelligence services could use the data to coerce agents and their families.
The breach is also a clear supply-chain failure. The weak point was a contractor-managed HR platform, not the FBI's core network. Leatherman's statement puts the cause on a patch that was available but not applied. If QPulse's identification of Dubrovsky holds, there is a second lesson: the "crisis vendors" victims bring in during an extortion event, such as negotiators, can themselves be a risk to the integrity of incident response. That point should stay conditional until the charges are confirmed.
The Attack Technique
According to 404 Media (via TechCrunch), the attackers first breached an Oracle PeopleSoft server, which recruiters use to store applicant data. From there they moved into Amazon-hosted government cloud infrastructure; QPulse specifies AWS GovCloud. ShinyHunters told NBC it used the jobs portal as a way into other agency programs.
Google Threat Intelligence Group and Mandiant gave useful context on September 25. They reported renewed mass exploitation of CVE-2026-35273, a PeopleSoft Environment Management Hub (PSEMHUB) flaw, by UNC6240 (ShinyHunters). The group had first used it as a zero-day against universities in June. In the newer wave, the actors bypassed string-based WAF rules by URL-encoding a single character, requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAFs match the literal path, but the PeopleSoft server decodes it and routes the request to the vulnerable servlet. Google says web shells were deployed on dozens of systems worldwide, including government targets. No source in this set officially confirms that CVE-2026-35273 was the entry point at the FBI. Still, the timing, the PeopleSoft platform and the FBI's "explicitly issued" patch language all fit that campaign.
What Organizations Should Do
- Patch PeopleSoft now. Apply Oracle's Security Alert fix for CVE-2026-35273. Google is explicit that WAF rules and path blocking do not replace the patch.
- Remove the attack surface. Disable the EMHub service in multi-server deployments, or remove PSEMHUB entirely in single-server ones, as Oracle advises.
- Hunt for encoded variants. Search PIA WebLogic access logs for
/PSEMHUB/and any percent-encoded form of it. Check web roots for web shells. - Hold contractors to patch SLAs. For third-party-managed platforms, require evidence that patches were applied, and keep the right to audit. The FBI's lesson is that outsourcing the platform does not outsource the risk.
- Segment HR systems from cloud data stores. Restrict and monitor the paths from internet-facing applicant portals into the cloud environments that hold workforce data, and alert on unusually large outbound transfers.
- Vet crisis vendors. Before you engage incident response or negotiation firms, do due diligence on them, log their access during the engagement, and limit what they can see to what the engagement needs.
Sources: FBI Recruitment Portal Breach and Arrest of Ransomware Negotiator E... | ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle Pe... | FBI Statement on Compromise of fbijobs.gov Portal and ... | FBI Blames Contractor's Missed Patch for ShinyHunters Breach - Secu... | Agents fearful and angry after 'dangerous' FBI data breach | Hacking group ShinyHunters claims it breached the FBI, stole agents... | FBI arrests co-conspirator in hacking group breach of jobs site AP... | FBI says contractor failure led to hack of its jobs website