Hackers have apparently breached FBI systems and have extracted personal data “on all FBI employees and applicants.” The data reportedly inc

ShinyHunters, tracked by Mandiant as UNC6240, claims it used an unpatched Oracle PeopleSoft zero-day for remote code execution to enter FBI systems on Monday, September 21, 2026, then moved laterally into FBI-managed AWS GovCloud infrastructure and extracted a claimed 2TB to 3TB of data covering current and former employees, job applicants, and internal records. The group defaced apply.fbijobs.gov with its Umbreon logo and a message reading "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since '19 ;)", claims it also reached FBI Criminal Justice, HR, and Medlink services, and says the agency killed its access across multiple networks within hours. The FBI's only on-record response is that it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating," which confirms an inquiry but not a breach. 404 Media reviewed a sample of roughly 5,000 purported employee records containing names, home addresses, phone numbers, and spouse details, and verified some phone numbers against people associated with the Department of Justice.

The volume claim matters less than the granularity: Reuters reports the haul includes job assignments and intelligence roles of bureau officials, exactly the data that lets a criminal identify, track, and threaten the agent working their case, a pattern already seen after the AT&T breaches, and the same dataset is a targeting windfall for foreign intelligence services. ShinyHunters frames the operation as retaliation for the FBI's May 15 IC3 PSA I-051526-PSA describing its harassment and swatting tactics, gave the bureau one week to retract it, and insists the attack is not financially motivated, which makes any leak publication unusually predictable in timing. The broader fact is capability, not grievance: this is the same actor that mass-exploited PeopleSoft CVE-2026-35273, a CVSS 9.8 unauthenticated RCE, against over 100 organizations (68 percent higher education) in May and June, and that in September renewed that n-day campaign across government, healthcare, and technology using a /%50SEMHUB/ URL-encoding bypass against defenders who relied on WAF rules instead of patching. A claimed FBI breach is proof-of-capability advertising for the extortion campaign the group says it is now running against Fortune 500 targets, and it demonstrates the playbook works on networks that had the June advisory in hand for over three months.

Organizations running PeopleSoft should treat this as two separate problems: the patched CVE-2026-35273 (PeopleTools 8.61 and 8.62, Oracle Security Alert of June 10, 2026) and a second PeopleSoft zero-day the group claims to hold and says is still unpatched. Apply the Oracle Security Alert patches rather than trusting WAF rules, disable the Environment Management Hub service in multi-server configurations or remove the PSEMHUB application on single servers, and block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector on normalized paths. Hunt in PIA WebLogic access logs for POST requests to /PSEMHUB/hub or /%50SEMHUB/hub from external source IPs, including the quiet bursts of five to fifteen serialized-object POSTs Mandiant identifies as exploitability checks; scan /webserv//applications/peoplesoft/PSEMHUB.war/ for x.jsp, u.jsp, tunnel.jsp, tunnel.jspx, or Ple64.exe; and alert on cmd.exe or /bin/sh spawned by the WebLogic Java process, outbound SMB on TCP 445 or rsync on TCP 873 from PeopleSoft hosts, and MeshCentral agents calling azurenetfiles.net, microsoft-entra.net, enroll.azuredevice.cloud, or winmanage-me.network at 5.199.162.157, 104.219.234.138, and 162.219.30.165. Rotate credentials readable by the PeopleSoft service account, including the database connection strings in psappsrv.cfg, and treat any discovered web shell as full compromise, since a quarter of the observed actor commands ran as root or SYSTEM.

Two developments would move this assessment. An Oracle statement or out-of-band Security Alert confirming the second PeopleSoft zero-day, or Mandiant correlating the FBI intrusion with the x.jsp, u.jsp, and Ple64.exe (SIDEEYE) tooling from the September campaign, would confirm the new bug and show the actor's full post-exploitation stack now reaches government networks. Watch the ShinyHunters leak site against its one-week deadline tied to the May 15 PSA: publication of the claimed 2TB to 3TB archive, or independent verification of the 5,000-record sample, would convert an unconfirmed claim into a mass exposure event for current and former bureau staff and applicants.