Vulnerability · Patch Management

ShinyHunters Claims FBI Hack and Data Theft in PeopleSoft Zero-Day Breach

September 23, 2026 · 6 min read

On the night of September 22, 2026, ShinyHunters announced they had breached FBI systems through what they described as a previously undocumented Oracle PeopleSoft zero-day vulnerability giving pre-authenticated remote code execution. They defaced FBIjobs.gov, claimed to have moved laterally into FBI-managed AWS GovCloud infrastructure, and stated they had exfiltrated between 2 TB and 3 TB of data covering current and former FBI employees, job applicants, and internal records. The FBI confirmed awareness of the claims and said it was investigating, but as of September 22 had neither confirmed nor denied the breach. Oracle and AWS did not respond to media inquiries. That uncertainty matters, because the technical and operational picture around this group and this vulnerability family is concrete enough to drive real action right now, regardless of how the FBI investigation resolves.

What actually happened

ShinyHunters provided a data sample to 404 Media, which was the first outlet to report the incident. The sample reportedly included names, home addresses, and phone numbers for approximately 5,000 alleged FBI employees, along with information on their spouses. Nextgov/FCW reviewed a portion of the sample and found that some names could be partially corroborated via open-source queries, with roles including special agents, intelligence analysts, attorneys, and student trainees. The full claimed dataset, described by ShinyHunters as covering all FBI employees and applicants, has not been independently verified, and the total scope of 2 to 3 TB should be treated as an unconfirmed claim.

The group says the intrusion path ran through FBIjobs.gov, the FBI's public-facing recruiting portal, which ran on Oracle PeopleSoft. After claiming initial access via a pre-auth RCE zero-day in PeopleSoft, they say they moved laterally into FBI Criminal Justice systems, HR systems, and a service called Medlink, and eventually into AWS GovCloud infrastructure managed by the FBI. The AWS GovCloud claim has not been confirmed by AWS, and the lateral movement details remain unverified. The group then defaced FBIjobs.gov with a seizure banner, and the site was offline for maintenance as of September 22.

ShinyHunters' stated motivation is unusual. They directed their demand at FBI Director Kash Patel and Cyber Division head Brett Leatherman, calling for the FBI to retract or correct a May 2026 FBI FLASH and PSA report that they claim contained false allegations about the group, including accusations of harassment, swatting, and affiliation with The Com. They set a one-week deadline and stated explicitly the attack is not financially motivated. They also warned they are already deploying the same alleged zero-day against Fortune 500 organizations, though no corroborating victims have been identified as of publication.

"The data is out there and has likely been repeatedly downloaded and passed around to other threat actors." — Allan Liska, Recorded Future, via Axios

That quote from Liska captures the operational reality here. Whether or not every detail of the ShinyHunters claim is accurate, once a data sample containing PII on federal law enforcement officers and their families circulates in threat actor communities, the downstream harm continues independently of any investigation outcome.

Why this should matter to you even if you don’t run Oracle PeopleSoft

This incident is directly connected to a documented and confirmed vulnerability campaign that ran from May 27 through June 9, 2026. During that window, ShinyHunters, attributed by Mandiant and Google's GTIG to cluster UNC6240, exploited CVE-2026-35273, a CVSS 9.8 unauthenticated SSRF-to-RCE in Oracle PeopleSoft's Environment Management Hub, against more than 100 organizations, predominantly in higher education. Oracle published an out-of-band security alert on June 10, 2026, covering PeopleTools versions 8.61 and 8.62. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 12, 2026. Exabeam VP Steve Povolny noted that ShinyHunters had attempted to hit an FBI PeopleSoft server during that earlier campaign and reportedly failed at the time.

Whether the FBI breach, if confirmed, exploits a genuinely new zero-day distinct from CVE-2026-35273, or a bypass of an unpatched instance of that same vulnerability, has not been established. No CVE identifier, affected PeopleTools version, or indicators of compromise for the newly claimed vulnerability have been publicly confirmed. That ambiguity is itself a signal worth paying attention to. If your organization runs PeopleSoft for HR, recruiting, or student information systems and had not patched CVE-2026-35273 within days of the June 10 advisory, you were exposed during the initial campaign window and may remain exposed now.

PeopleSoft is pervasive in enterprise HR, higher education, and government. The FBI's recruiting portal is a public-facing web application built on the same product stack that runs payroll, benefits, and applicant tracking for hundreds of large organizations. Internet-exposed PeopleSoft instances are a recurring target precisely because they aggregate high-value personal data and are often on slower patch cycles than perimeter network gear. The combination of a pre-auth RCE entry point with a rich data target behind it is exactly the pattern insurers and security architects worry about when they talk about internet-facing enterprise applications.

The control that would have blunted it

The control category here is patching, specifically the speed and completeness of patching for internet-exposed enterprise application servers. CVE-2026-35273 carried a CVSS score of 9.8, was added to the CISA KEV catalog within two days of the Oracle advisory, and was already being actively exploited against more than 100 organizations before Oracle published the patch. That sequence means the effective window for safe remediation was measured in days. The typical 30-day patching cycle that many organizations still treat as acceptable for enterprise applications was already obsolete before the patch was available.

The specific control is a tiered, risk-based patching policy that places internet-exposed application servers, particularly those running HR, recruiting, or student information systems, in a high-priority tier with a defined SLA of 72 hours or fewer for CVSS 9.0 and above or any KEV-listed vulnerability. That policy needs to include PeopleSoft's Environment Management Hub and any other administrative or integration components exposed to the network, covering the end-user-facing portal as well as the PSEMHUB component and similar administrative interfaces. The PSEMHUB component that CVE-2026-35273 targeted is a PeopleSoft administration interface that many organizations leave exposed without fully accounting for its attack surface.

Cyber insurers increasingly ask about patch SLAs during underwriting and at renewal. A written, tested, and auditable patching policy covering internet-facing application servers is a baseline underwriting requirement for most carriers offering coverage above mid-market limits. Demonstrating that you can patch a CVSS 9.8 KEV-listed vulnerability within 72 hours, with evidence, is the kind of documentation that affects both your coverage terms and your incident response posture when a breach claim is filed.

The honest operational caveat is that patching PeopleSoft in a large enterprise is genuinely difficult. PeopleTools upgrades require testing against customizations, integrations, and downstream systems, and the change management overhead is real. Some organizations run PeopleSoft versions that are years behind current, partly because the testing burden is significant and partly because the business units that own the system push back on maintenance windows. A CVSS 9.8 pre-auth RCE being actively exploited overrides that operational friction in the risk calculus. The answer to that operational friction is compensating controls, specifically network segmentation that limits what an authenticated session in PeopleSoft can reach internally, and aggressive monitoring for anomalous lateral movement, while the patch is tested and deployed. Compensating controls documented and verified before an incident are what give you something to show an insurer or a regulator when the timeline is scrutinized.

If your organization relies on vendor or third-party access to PeopleSoft or similar enterprise HR platforms, Strondex's Vendor Access product helps you enforce least-privilege access controls, monitor third-party sessions, and maintain audit-ready documentation of who accessed what and when.