ShinyHunters Claims PeopleSoft Zero-Day Led to 2-3TB FBIJobs.gov Data Theft

ShinyHunters claims to hold 2-3TB of sensitive information about FBI employees and applicants after an alleged compromise of the FBIJobs.gov portal. The portal was offline on Wednesday, September 23, 2026, as the claims circulated. The FBI says it is aware of the claim and is actively and aggressively investigating it Engadget.

The group says it obtained the data using a zero-day exploit in Oracle's PeopleSoft to reach Amazon Web Services GovCloud servers. A ShinyHunters spokesperson told 404 Media: "We hacked the FBI. We hold data on all FBI employees and applicants." 404 Media reported it received confirmation of the attack from a ShinyHunters representative, while Reuters reported it had seen a sample of the data allegedly obtained.

That sample, as described in reporting, contained names, addresses, telephone numbers, dates of birth, Social Security numbers and emergency contact details for 5,000 FBI employees. The alleged stolen data may also include work assignments for agents and details about FBI units working on intelligence, security and counter-espionage efforts including operations focused on China and Russia.

The FBI described the incident in narrow terms. It said it was aware of a cyber-criminal group claiming a compromise of the FBIJobs.gov portal with alleged impact to FBI employee personally identifiable information. The scope is unconfirmed. Nextgov reported that the full scope of the claimed breach remains unclear, and the Bureau has framed its work as an investigation into a claimed compromise rather than a confirmed breach.

The motive asserted by the claimants is unusual. ShinyHunters claimed the FBI attack was not financially motivated but aimed to coerce the FBI to remove or amend a previous statement about ShinyHunters. That prior statement dates to a May report in which the FBI said ShinyHunters exaggerated claims of access to sensitive or personal information to prompt payment from victims. Reuters described ShinyHunters as a digital extortion group.

The public timeline moved quickly. Reuters reported on September 22, 2026 that ShinyHunters said it had breached the FBI and stolen data. Politico reported the same day that the FBI said it was probing a suspected hack after ShinyHunters claimed to have breached its systems. BleepingComputer published a report titled "ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach" about the claimed incident.

The FBI claim did not arrive in isolation. ShinyHunters claims to have breached an online platform for the Florida Department of Motor Vehicles database known as DAVID, a claim reported on September 8, 2026. The group has also claimed responsibility for a recently disclosed Ernst and Young data breach, reported on July 27, 2026. Separately, the FBI seized a BreachForums domain used by ShinyHunters as a data leak extortion site for widespread Salesforce attacks, an action reported on October 10, 2025.

The broader context here matters for defenders and architects more than the headline terabyte figure. Recruitment portals concentrate exactly the data that is hardest to rotate: identity documents, contact graphs, employment history, and applicant PII that persists even after hiring decisions are made. A PeopleSoft front end sitting in front of GovCloud-hosted workflows would, if the claimed path is accurate, put identity lifecycle infrastructure directly adjacent to sensitive internal assignments. That adjacency is worth flagging for any enterprise team running HR, applicant tracking, or contractor onboarding on hybrid infrastructure.

In this author's view, the prudent posture is to treat volume claims and sample claims as separate problems. Samples can be validated against known breach corpuses, formatting artifacts, and internal consistency without accepting a 2-3TB total at face value. Extortion groups have incentives to inflate totals, as the FBI itself noted in May, and defenders have incentives to prepare as if the worst case is true. Both can be correct at once. The useful work now is credential rotation for exposed personnel, monitoring for secondary use of emergency contacts, and review of trust boundaries between public-facing application layers and restricted enclaves.

What this episode may ultimately improve is unglamorous and practical. Segmentation between applicant-facing systems and internal assignment data, tighter patching and virtual patching for enterprise HR platforms, and cleaner retention policies for applicant PII all reduce the blast radius of the next claim, real or inflated. Those controls do not make recruitment systems invulnerable. They make them less rewarding to target.