ShinyHunters say they stole data on all FBI employees through an HR system

A hacking group says it is holding the personnel file of everyone who works for the FBI, used to work for it, or ever applied. ShinyHunters told 404 Media it got in through the bureau's recruitment system, pulled two to three terabytes out of a government cloud, and defaced the FBI jobs portal on Tuesday. It is not asking for money. It wants the FBI to delete a notice the agency published about the group, and it has given the bureau a week.

The FBI has confirmed nothing. What can be checked from outside is narrow but real: the jobs portal is offline, and the reporters who saw a sample of the data matched part of it against public records.

What the group says it took

"We hacked the FBI. We hold data on all FBI employees and applicants," a representative of the group told 404 Media on 22 September. The same representative described the route: a zero-day in Oracle PeopleSoft, the software the bureau runs its hiring on, then a move sideways into servers in AWS GovCloud, where the data was downloaded. Three internal services are named in the claim: Criminal Justice, Human Resources and Medlink.

The defacement left on the jobs site was written to imitate a law enforcement takedown banner: "this site has been seized by ShinyHunters", followed by a claim that all FBI data was compromised, including personal and health information on current and former staff and on every applicant, and the line "We have a lot more than we claim here."

Asked whether this was an extortion attempt, the representative gave an answer worth reading twice: "what we plan to do is not something I'd call extortion, maybe coercion." And then: "This is not financially motivated." What the group wants is for the FBI to withdraw the public notice it published about ShinyHunters, which the group says contains false claims. The deadline is one week, after which it threatens to publish.

What holds up and what does not

An extortion crew is a poor primary source, and this one has an obvious interest in sounding larger than it is. So it is worth separating the claim from the part anyone can verify.

The PeopleSoft hole behind it

PeopleSoft is Oracle's back-office suite for payroll, HR and student records. The component in question, the Environment Management Hub, is an internal service that was never meant to face the internet, and in June it turned into one of the year's ugliest holes. CVE-2026-35273 scores 9.8 out of 10: no login, no user interaction, just an HTTP request to take over the server.

1. 15 May 2026The FBI publishes a public notice on ShinyHunters, describing the group's extortion and harassment methods.
2. 27 May 2026Mandiant later dates the start of exploitation of the PeopleSoft flaw to this day.
3. 9 June 2026End of the exploitation window Mandiant reconstructed. The group is tracked as UNC6240.
4. 10 June 2026Oracle ships an out-of-band patch for CVE-2026-35273.
5. 12 June 2026CISA adds the flaw to its catalogue of vulnerabilities known to be exploited.
6. 21 September 2026ShinyHunters says it found a new PeopleSoft flaw that night and used it against the FBI within hours.
7. 22 September 2026The jobs portal is defaced, then taken down. The ultimatum appears on the group's leak site.

The June campaign was not small. Mandiant warned more than a hundred organisations that their systems were exposed, and about 68 percent of them were universities. One of them, the University of Nottingham, ended up with the records of 455,000 students published on a leak site.

That history is why the FBI case is ambiguous rather than obvious. The screenshot the group shared points at the same component Oracle patched in June. Either there is a second flaw in the same place, or the bureau's server never received the June update. The group insists the bug is new and undisclosed. Oracle has not said a word either way.

Why a recruitment database is the worst thing to lose

A hiring system sounds like a filing cabinet of CVs. It is not. To process one applicant it has to store a home address, a date of birth, a personal phone number, next of kin, and for any job with a medical exam, health records. That is why the defacement mentions health information, and why one of the three named services is called Medlink. An HR database holds the things a passport application asks for, on people who never became employees.

For most employers that is a privacy problem. For a law enforcement agency it is an operational one. 404 Media points out that criminals from this same ecosystem have already used stolen phone records to track, intimidate and harass the FBI agents investigating them. TechCrunch frames the risk in counterintelligence terms: a list of agents, their home addresses and their spouses is exactly the material a foreign service uses to pressure someone into cooperating. This is also the second known intrusion into an FBI system this year, after unidentified hackers reached a system used to manage real-time wiretaps and foreign intelligence warrants.

Who else runs PeopleSoft

ShinyHunters told CyberInsider it intends to use the new flaw against a much broader set of targets. That matters well beyond Washington, because PeopleSoft runs the payroll and student records of universities, ministries and large employers across Europe, Latin America and Asia. The June wave showed the shape of it: a hundred organisations in a fortnight, mostly campuses, because campuses run these systems with a small team and an internet-facing admin interface.

There is nothing an applicant can do about any of this. If you sent a CV to a large institution at some point in the last decade, your file is probably sitting in a system of this kind, you were never told which one, and you cannot check whether it has been patched.

What to do if your file could be in something like this

The realistic risk for an ordinary reader is not that a foreign service is after them. It is the wave of well-informed phishing that follows any breach of this size, where the caller knows your former employer, your address and your date of birth, and uses that to sound official. We have written before about how quickly stolen registry data turns into fake official demands, and the pattern does not change.

• Treat any message about this breach as bait, including one that appears to come from the agency itself
• Search your email addresses on Have I Been Pwned and turn on alerts for new leaks
• Replace SMS codes with an authenticator app or a hardware key on mail and banking
• Ask former employers and universities to erase the application file they no longer need
• Search your own phone number in a logged-out browser and see what comes back
• Freeze your credit file if your country offers it