ShinyHunters Claims FBI Hack via Oracle PeopleSoft Zero-Day

Extortion group ShinyHunters claims to have compromised FBI internal systems and exfiltrated terabytes of sensitive personnel records by exploiting an unpatched Oracle PeopleSoft zero-day vulnerability. The intrusion resulted in the defacement of the agency’s recruitment site, apply.fbijobs.gov, and forced federal administrators to take affected networks offline. While the FBI has confirmed an ongoing investigation into unauthorized activity on FBIjobs.gov, the threat actors assert that the same remote code execution exploit is currently being deployed against corporate targets across the Fortune 500.

Overview of the Incident and Data Exposure

The intrusion came to light after ShinyHunters defaced the FBI Jobs portal with their signature Umbreon Pokémon logo and a message claiming site control. The defacement message taunted federal law enforcement while asserting that sensitive personally identifiable information (PII) and protected health information (PHI) belonging to incumbent employees, former staff, and job applicants had been fully compromised.

The threat group claims to have exfiltrated between 2TB and 3TB of data during the intrusion, which reportedly began on a Monday night. According to the actors, affected services include FBI Criminal Justice records, internal HR platforms, Medlink services, and related backend storage hosted within the agency’s AWS GovCloud infrastructure.

To support their claims, ShinyHunters shared sample records containing internal personnel details. Independent review of a separate sample containing approximately 5,000 records confirmed authentic phone numbers and contact details corresponding to U.S. Department of Justice and FBI personnel, including specific files allegedly belonging to an agent previously involved in investigating BreachForums and FBI Director Kash Patel. Following the breach detection, the FBI took affected infrastructure offline, replacing the job site with a maintenance notice and terminating remote network access.

Exploit Mechanics and Lateral Cloud Movement

The initial access vector relied on a previously unknown remote code execution (RCE) flaw in Oracle PeopleSoft. Enterprise Resource Planning (ERP) platforms like PeopleSoft integrate deeply into core administrative workflows—including payroll, HR, and benefits administration—making them exceptionally high-value targets for threat actors.

In PeopleSoft architectures, RCE vulnerabilities typically manifest in the underlying web application tier, such as Oracle WebLogic Server or PeopleTools Integration Broker services. Common exploitation pathways involve unauthenticated Java deserialization, path traversal flaws leading to file writes, or improper input validation within open web service endpoints. Successful exploitation allows an attacker to execute arbitrary system commands with the privileges of the web application service account.

ShinyHunters indicated that after gaining initial execution on the local PeopleSoft application host, they purged server logs to obfuscate the exploit chain before moving laterally into connected cloud storage. In hybrid federal environments, on-premises or cloud-hosted ERP application tiers frequently hold stored credentials, IAM roles, or configuration files that allow interaction with backend data repositories. By leveraging these access tokens or compromised system credentials, the actors pivoted directly into the FBI’s AWS GovCloud environment to harvest databases containing applicant histories and health records.

Extortion Demands and Retaliation Claims

Unlike typical ransomware or extortion campaigns where monetary payment is the primary goal, ShinyHunters claims this attack was launched as direct retaliation for an FBI FLASH report issued in May 2026. The law enforcement advisory detailed ShinyHunters’ tactics and associated the group with aggressive harassment, swatting, and membership in “The Com”—a loose network of cybercriminals known for SIM swapping, extortion, and physical violence.

In a published statement on their leak platform, ShinyHunters disputed the FBI’s characterization of their operations, denying involvement in swatting or physical harassment. The group issued a one-week deadline demanding that the FBI retract or amend the FLASH report, stating that the demand was non-financial. When asked whether the stolen personnel records would be published if the agency failed to comply, the group declined to specify, while remaining indifferent to potential law enforcement escalation.

This incident follows a pattern of high-profile exploitation by ShinyHunters involving Oracle products. The group previously surfaced during Clop’s 2025 Oracle E-Business Suite campaign under the moniker “Scattered Lapsus$ Hunters,” where they leaked a zero-day exploit proof-of-concept later confirmed by Oracle. That dispute recently escalated when ShinyHunters compromised and defaced Clop’s own data leak site, claiming to have stolen server configuration data and Tor onion keys in retaliation for past conflicts.

Impact and Enterprise Risk Mitigation

The potential blast radius of an unpatched Oracle PeopleSoft zero-day vulnerability extends far beyond federal law enforcement. PeopleSoft remains a foundation for human resources, student administration, and financial services in government agencies, higher education institutions, and Fortune 500 enterprises globally. Because ShinyHunters explicitly reported actively targeting corporate entities with the same vulnerability, organizations running PeopleSoft applications must treat web-facing instances as high-risk targets.

To mitigate exposure and detect potential exploitation attempt before official vendor patches become available, security teams should implement immediate defensive controls:

• Restrict Network Exposure: Immediately isolate PeopleSoft WebLogic and PeopleTools endpoints from the public internet. Access to administrative interfaces, Integration Broker nodes, and applicant portals should require strict access control lists or authenticated VPN access.
• Inspect Web Server Logs: Audit web tier logs (including WebLogic access.log and HTTP server logs) for anomalous POST requests directed at unexpected URI paths, particularly those targeting Java web services, HTTP class renderers, or unauthenticated integration endpoints.
• Monitor Process Execution: Review process creation events originating from the PeopleSoft application service account (e.g., PIA or bea). Watch for child processes spawning shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) or utility commands used for reconnaissance (whoami, net, curl, wget).
• Audit Cloud Storage Access: Organizations hosting PeopleSoft within cloud environments (AWS, Azure, OCI) should review IAM role permissions associated with application instances. Inspect CloudTrail or equivalent cloud audit logs for sudden spikes in data access, bulk S3 object reads, or external sync operations originating from application servers.