ShinyHunters Claims It Breached the FBI Through a PeopleSoft Zero-Day — What's Confirmed, What Isn't, and What PeopleSoft Shops Should Do Now

On September 22, 2026, ShinyHunters claimed it had breached the FBI. The entry point, according to the group, was an unpatched remote-code-execution flaw in Oracle PeopleSoft running the Bureau's recruiting portal, apply.fbijobs.gov — followed by a pivot into FBI-managed AWS GovCloud infrastructure and the theft of 2–3TB of data on agents, staff and job applicants. The FBI has confirmed only that it is investigating. Much of this story is still claims, so this piece keeps them separate from what is actually established — and ends with what matters most for everyone else: the group says it is now using the same zero-day on Fortune 500 companies.

What is confirmed

• The FBI is investigating. Its full statement: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." It has not confirmed a breach or data theft.
• The recruiting site was defaced. apply.fbijobs.gov displayed the group's Umbreon logo and the message "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since '19 ;)", and was later replaced by a maintenance page.
• Some leaked records look real. 404 Media reviewed roughly 5,000 purported FBI employee records and found that some details — phone numbers matched to the right names — were accurate.

What is only claimed

Oracle, AWS and Mandiant had not responded to press inquiries at the time of the first reports. The group quoted to BleepingComputer: "The Oracle product we exploited the 0day in is PeopleSoft. We found another one yesterday and immediately exploited it on the FBI."

Why they say they did it

ShinyHunters says this is not about money. It wants the FBI to retract a May 15, 2026 FLASH bulletin that described the group harassing victims and their families with threatening calls and texts and, in some cases, swatting. It gave the Bureau a one-week deadline, and when asked whether it would publish the data if the demand was not met, said "no comment."

A group that usually extorts for payment choosing a reputational demand against a law-enforcement agency changes the calculus in one important way: there is no ransom to pay that ends the incident. Whatever happens to the data is decided entirely by the attackers.

Why a job portal is a dangerous front door

Recruiting and applicant portals are some of the most exposed enterprise application surfaces an organization runs. They must be reachable by anyone on the internet, they accept uploads and free text from strangers, and in ERP suites like PeopleSoft they often sit on the same application tier as HR and payroll data. If the claim is accurate, the path was textbook: a public-facing application, an unpatched flaw, code execution on the app server, then credentials or roles on that server used to reach cloud infrastructure behind it. The zero-day opens the door — what the app server can reach decides how far an attacker walks through it.

A pattern worth noticing

ShinyHunters has had a busy 2026: it claimed the Instructure Canvas breach in May and a multimillion-dollar extortion of McKesson earlier this month, and it has been linked to exploitation of Oracle E-Business Suite in 2025. Oracle's business application suites keep appearing in these campaigns — large, customized, often internet-facing, and slow to patch in practice.

If you run PeopleSoft: what to do now

1. Assume there is no patch yet. Until Oracle publishes an advisory, treat internet-facing PeopleSoft as exposed to an unpatched RCE.
2. Reduce exposure first. Inventory every public PeopleSoft entry point — recruiting, candidate gateway, self-service, supplier portals — and put anything that does not need to be public behind a VPN, zero-trust proxy or at minimum a strict WAF.
3. Hunt on the web and app tier. Look for unexpected child processes of the application server, new or modified files in web directories (webshells), new scheduled jobs, and unusual outbound connections — especially to cloud storage or unfamiliar hosts.
4. Map what the app server can reach. The claimed jump into GovCloud implies cloud credentials or roles were usable from the application tier. Check instance roles, stored keys and service accounts on PeopleSoft hosts, and cut anything broader than the application strictly needs.
5. Watch cloud audit logs. Review CloudTrail (or equivalent) for API activity originating from PeopleSoft hosts or their roles — new keys, unusual data access, bulk reads from storage.
6. Prepare for the applicant angle. Job applicants' data (identity documents, résumés, contact details) is a real breach-notification obligation. Know where it lives and who you would have to notify.
7. Track Oracle's security alerts for an out-of-band fix, and apply it on an emergency change window when it lands.

The takeaway

Most of this story is still the attacker's account, and it should be read that way. But you don't need the FBI's confirmation to act on the part that affects you: a public-facing PeopleSoft portal is a plausible entry point, a zero-day is claimed to be in active use, and the damage depends less on the bug than on what your application servers are allowed to reach. That last part is entirely within your control today.

PlayCISO is not affiliated with the FBI, Oracle or any party named here. This article is based on public reporting by BleepingComputer, The Register, TechCrunch, Axios, 404 Media and others as of September 23, 2026. Claims attributed to ShinyHunters are unverified; details may change as the investigation continues.