The extortion group ShinyHunters says it broke into the Federal Bureau of Investigation on the evening of Monday, September 21, 2026, through the bureau's FBIjobs.gov recruitment portal, and stole data on current and former FBI employees and job applicants. On September 23 the FBI said publicly that it was "actively and aggressively investigating" a claimed compromise of the portal. It added that the point of breach, "whether a third-party or the FBI's enterprise," was "still undetermined." Most of the scale figures come only from the attackers. ShinyHunters told BleepingComputer it took 2TB to 3TB of data and told 404 Media it took "terabytes." It claims to hold data on "almost all FBI agents." A sample given to 404 Media reportedly covered about 5,000 people (per İLKHA). Since then, MS Now reported, and TechCrunch relayed, that the FBI sent staff an internal notice declaring a "cyber security incident" and saying that names, addresses, job titles and Social Security numbers were exposed. The bureau has not publicly confirmed data theft beyond its September 23 statement.
What Happened
ShinyHunters announced the intrusion on its dark web leak site on Tuesday, September 22. TechCrunch and Reuters reported the claim that day, after 404 Media broke the story. According to the group, it got into FBI systems on Monday night and moved from there into other environments.
ShinyHunters sent BleepingComputer a screenshot showing apply.fbijobs.gov defaced with the group's Umbreon Pokémon logo. The message read "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since '19 ;)" and claimed that PII and health information on employees and applicants had been stolen. Soon afterwards the jobs site showed a "down for maintenance" notice, and the Special Agent Applicant Portal was also offline (TechCrunch, İLKHA).
The FBI's public statements have been careful. Its first comment to TechCrunch and BleepingComputer said only that it was "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." The formal September 23 press release said the bureau was working with "third-party providers that support fbijobs.gov." On September 26, MS Now reporter Ken Dilanian reported that staff had received an internal notice declaring a cyber security incident. TechCrunch called this the bureau's first acknowledgment that agents' personal data was taken. The FBI has not confirmed it publicly.
The group says the attack is "not financially motivated." It wants the FBI to remove or correct a May 2026 advisory that described ShinyHunters' methods. Reuters reports that the advisory told victims not to pay. The BBC reported that the group threatened to publish the stolen databases and documents within four days if its demands were not met.
What Was Taken
Nearly every claim about scope comes from the attackers, and the figures vary:
- Volume: BleepingComputer was told 2TB to 3TB. 404 Media, as cited by TechCrunch and İLKHA, was told "terabytes." Neither outlet has verified either figure.
- People affected: ShinyHunters told TechCrunch it has "data on mostly all of FBI" and a "substantial" amount on applicants. The only sample described publicly was reportedly linked to about 5,000 people (İLKHA, citing 404 Media). That is a sample size, not a total.
- Data types in the sample: names, home addresses and phone numbers of FBI agents and their spouses. 404 Media checked part of this against public records. Reuters says the sample also seemed to include some agents' assignments.
- Data types in the reported internal notice: names, addresses, job titles and Social Security numbers (MS Now, via TechCrunch).
- Health data: TechCrunch says several outlets have confirmed medical information in the stolen data, including blood and urine test records and psychiatric reports. This fits the defacement's claim of stolen PHI.
- Wider systems: ShinyHunters told BleepingComputer it also got into FBI Criminal Justice, HR, Medlink and other services. No one has corroborated this, and it should be treated as an unverified claim.
Why It Matters
This goes well beyond an ordinary HR data breach. TechCrunch points out that home addresses, family details, assignments and medical or psychiatric records on federal agents are a ready-made counterintelligence resource, since foreign services could use them to coerce or extort agents and their families. Former agents told the BBC they are most worried about undercover personnel. They also fear targeted phishing, bribery attempts, and "violence-as-a-service" or swatting by young online gangs whose members some agents have investigated. The BBC notes that groups like ShinyHunters have been linked to swatting and to petrol bomb attacks on law enforcement officers.
The motive also stands out. ShinyHunters is a known data-theft and extortion operation, and the FBI's May advisory said it had hit technology, finance and retail companies, sometimes exposing millions of customer records. Here, though, the group is demanding that a government agency change a public threat report rather than pay a ransom. Reporting on a group's tradecraft can itself make an organization a target.
The Attack Technique
According to TechCrunch, 404 Media reported that the attackers got into an Oracle PeopleSoft server, a platform HR and recruiting teams use to hold applicant data, and then moved into Amazon-hosted government cloud storage holding agent and applicant records. ShinyHunters told BleepingComputer the same story with more detail. It said it used a remote code execution flaw in PeopleSoft to get in and then moved into FBI-managed AWS GovCloud. BleepingComputer has not verified the vulnerability, the lateral movement or the data volume.
The reports disagree on what the vulnerability was. ShinyHunters calls it a new PeopleSoft zero-day, and it says it is now using the flaw against other organizations, including Fortune 500 companies. On September 25, Mandiant and Google Threat Intelligence Group (GTIG) published research on a renewed mass-exploitation campaign by UNC6240 (ShinyHunters) against CVE-2026-35273. This is a PeopleSoft flaw in the Environment Management Hub (PSEMHUB) endpoint. The group first used it as a zero-day against universities in June, and Oracle has since issued a Security Alert patch for it. In the new wave, the attackers get past string-based WAF rules by URL-encoding a single character, requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAFs match the path before decoding it, while PeopleSoft decodes the request and sends it to the vulnerable servlet. GTIG says web shells were deployed on dozens of systems worldwide, including some in government.
The Mandiant/GTIG post does not name the FBI, and none of the sources confirm that CVE-2026-35273 was the entry point. The actor, platform, timing and government targeting all match, but the "new zero-day" claim could equally describe this WAF bypass of a known, patched bug or a separate, undisclosed flaw. Until the FBI or Oracle says more, both are possible. The FBI has not ruled out that a third-party provider was the point of breach.
What Organizations Should Do
- Patch PeopleSoft now. Apply Oracle's Security Alert patch for CVE-2026-35273. Mandiant states plainly that WAF rules and path blocking are not a substitute for patching.
- Disable or remove EMHub. Turn off the Environment Management Hub service in multi-server deployments, or remove the PSEMHUB application entirely in single-server deployments, as Oracle advises.
- Hunt for encoded-path access. Search PIA WebLogic access logs for requests to
/PSEMHUB/and any percent-encoded variant such as/%50SEMHUB/. Look for web shells on any PeopleSoft host that was exposed. - Fix WAF normalization. Make sure WAF and reverse proxy rules decode and canonicalize URLs before matching. Test path-based rules on every internet-facing app against encoded variants.
- Limit what HR platforms can reach in the cloud. Restrict the credentials and network paths that recruiting and HR servers have into cloud data stores, including GovCloud tenants. Alert on unusual bulk reads or exports from those stores.
- Prepare for social engineering against your staff. If employee or applicant PII may have been exposed, warn staff about targeted phishing, impersonation and harassment. Organizations with law enforcement or security staff should also plan for doxxing and swatting risk.
Sources: Hacker group ShinyHunters claims FBI employee and applicant data br... | ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle Pe... | FBI Statement on Compromise of fbijobs.gov Portal and ... | Hacking group ShinyHunters claims it breached the FBI, stole agents... | Agents fearful and angry after 'dangerous' FBI data breach | FBI reportedly declares 'cyber security incident' after hackers ste... | ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach | ShinyHunters hackers say they breached FBI, stole data on ...