Reported by 12 outlets
ShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claim
Why this score
- Breadth
- 2.00 / 2.0 · 12 sources
- Authority
- 1.90 / 2.0 · best outlet weight
- Severity
- 1.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
ShinyHunters claimed on September 22, 2026 that it breached FBI systems, telling 404 Media it holds data on all FBI employees and applicants and shipping a sample of roughly 5,000 records with names, home addresses, phone numbers, and spouse details. The group claims 2 to 3 terabytes in total, taken through a second, still unpatched Oracle PeopleSoft zero-day RCE, with lateral movement into FBI-managed AWS GovCloud and access to Criminal Justice, HR, and Medlink services, and it defaced apply.fbijobs.gov with the message "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since '19". The FBI confirmed it is investigating unauthorized activity affecting FBIjobs.gov and pulled the job portal to a maintenance page, without confirming that data left its networks. On September 24 the FBI said in a public statement that the point of breach is still undetermined, whether a third party or the FBI's enterprise, that it is actively and aggressively investigating the matter together with the third-party providers supporting the jobs site, and that all personnel received an email warning them to take steps to protect themselves while the investigation continues; the portal remained offline. The motive is coercive rather than financial: one week to retract IC3 PSA I-051526-PSA, the May 15, 2026 advisory that accused the group of exaggerated access claims, harassment of victims' relatives, swatting, and fabricated compromising material.
The demand structure matters more than the volume. This breaks the group's own playbook: no ransom, no leak-site countdown, a political demand addressed by name to Director Kash Patel and Cyber Division Assistant Director Brett Leatherman, which means the usual negotiation and takedown calculus does not apply. Even if the reported figure of roughly 38,000 staff and applicants is inflated, the verified 5,000-record subset reportedly includes hundreds of intelligence analysts covering Russia, China, Hezbollah, and cartels, plus members of the Remote Operations Unit, the FBI's secretive exploit-development team. A name, home address, and family map of those people is a targeting package for foreign intelligence services and for the harassment ecosystems the FBI itself catalogued in the May PSA, and criminals in this scene have already used stolen telecom data to track and intimidate agents investigating them. That is why this story outranks the other thirty from today: it converts a personnel-data breach into a standing counterintelligence exposure that does not expire when the news cycle does.
PeopleSoft operators should treat the June campaign as precedent for the current claim. CVE-2026-35273, a CVSS 9.8 RCE in the Environment Management component, was exploited as a zero-day from May 27 to June 9, 2026 before Oracle's June 10 advisory, and Mandiant notified over 100 organizations, 68 percent of them higher education. Apply Oracle's CVE-2026-35273 patch, disable the EMHub service or remove PSEMHUB in single-server deployments, and block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter. Hunt WebLogic PIA access logs for POST /PSEMHUB/hub from external source IPs, outbound TCP 445 from PeopleSoft hosts, rogue .jsp files under PSEMHUB.war, modified .xml under envmetadata that could trigger XMLDecoder execution on restart, and the campaign artifacts README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT and fanout.sh. Mandiant's published indicators cover staging hosts 142.11.200.186 through 142.11.200.190 and the C2 wss://azurenetfiles.net:443/agent.ashx. ShinyHunters says it is already reusing the alleged new bug against Fortune 500 targets, has told the New York Times it plans to keep using the zero-day for its "businesses' normal operations", and Oracle has so far stayed silent on the claimed second vulnerability, so patching and perimeter blocks cannot wait for Oracle to confirm anything.
Two developments would move this assessment. Independent confirmation from Oracle, Mandiant, or the FBI that a second PeopleSoft zero-day exists would turn an unverified claim into an active federal-network exploitation case with a live unpatched vector. The one-week retraction deadline set on September 22 lands around September 29, and what happens there is diagnostic: a data release would suggest GovCloud-resident records, a quiet deadline extension or edited PSA would suggest the group holds little more than the portal export it already sampled.
Timeline
-
original reporting
ShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claim
zubiqo.com · 20d ago · September 23rd, 2026
ShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claim
via Mastodon https://zubiqo.com/news/fbi-probes-alleged-shinyhunters-hack-compromising-employee-data-6rocls
-
update from google.com
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
google.com · 125d ago · June 11th, 2026
Mandiant and GTIG disclosed the original campaign: UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day between May 27 and June 9, 2026, predating Oracle's June 10 advisory. The team notified over 100 organizations with correlated vulnerable endpoints, 68 percent of them higher education institutions, and documented MeshCentral staging infrastructure masquerading as Azure endpoints at azurenetfiles.net, a defacement marker file, zstd-packed exfiltration, and a June 9 leak site post. Open attacker staging directories on five 142.11.200.x hosts were flagged publicly on June 9.
-
update from 404media.co
'We Hacked the FBI:' Hackers Say They Have Data on All FBI Employees
404media.co · 21d ago · September 22nd, 2026
Joseph Cox reported a ShinyHunters representative claiming data on all FBI employees and applicants, with a sample of 5,000 alleged agents including names, home addresses, phone numbers and spouse details seen by 404 Media. The article notes criminals from the same ecosystem previously used stolen telecom data to track and harass FBI agents, and that the data would aid foreign intelligence services.
-
update from bleepingcomputer.com
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
bleepingcomputer.com · 21d ago · September 22nd, 2026
ShinyHunters told BleepingComputer it used the alleged zero-day on a Monday night, then moved laterally into FBI-managed AWS GovCloud infrastructure and compromised FBI Criminal Justice, HR, and Medlink services. It claimed 2 TB to 3 TB of employee, applicant, and internal records, shared a defacement screenshot of apply.fbijobs.gov, and said it was exploiting the same flaw against other organizations including Fortune 500 companies. BleepingComputer could not independently verify the zero-day, lateral movement, or data volume, and the FBI confirmed only that it was investigating unauthorized activity affecting FBIjobs.gov.
-
update from www.nytimes.com
Hackers Say They Stole Thousands of Sensitive F.B.I. Personnel Records https://www.nytimes.com/2026/09/23/us/politics/fbi-hack-shinyhunters-
www.nytimes.com · 20d ago · September 23rd, 2026
Hackers Say They Stole Thousands of Sensitive F.B.I. Personnel Records https://www.nytimes.com/2026/09/23/us/politics/fbi-hack-shinyhunters-
via Mastodon https://www.nytimes.com/2026/09/23/us/politics/fbi-hack-shinyhunters-data.html
-
update from arstechnica.com
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real https://arstechnica.com/tech-policy/2026/09/fbi-rushes-to-i
arstechnica.com · 20d ago · September 23rd, 2026
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real https://arstechnica.com/tech-policy/2026/09/fbi-rushes-to-i
via Mastodon https://arstechnica.com/tech-policy/2026/09/fbi-rushes-to-investigate-if-shinyhunters-hack-of-thousands-of-employees-is-real/
-
update from malware.news
ShinyHunters Claims Hack on FBI: Sensitive Data Compromised
malware.news · 20d ago · September 24th, 2026
Summary On September 23, 2026 , the hacking group ShinyHunters claimed responsibility for a cyberattack against the Federal Bureau of Investigation (FBI) ( fbi.gov ), alleging they have compromised sensitive data on FBI agents and job applicants. The group demands the removal of a FLASH report they claim contains false allegations against them. Incident Report Field Details Target Federal Bureau of Investigation (FBI) Domain fbi.gov Country USA Attacking Group ShinyHunters Date Reported September 23, 2026 Threat Actor Statement “Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended…” Recommended Security Actions Ransomware attacks are increasingly targeting both enterprise and mid-sized organizations across all sectors. The following steps are critical to reduce impact and prevent future incidents: Monitor continuously: Use DeXpose’s dark web and infostealer monitoring platform to detect breached credentials, leaked databases, and threat actor chatter in near real-time—befo
-
update from malware.news
FBI Hack Exposed FBI’s Own Hacking Unit
malware.news · 20d ago · September 24th, 2026
Joseph Cox reports: The catastrophic hack of at least thousands of FBI officials’ personal data, including their addresses, phone numbers, and even their spouses, includes members of the FBI’s secretive hacking team, potentially revealing who exactly is in that unit, 404 Media has found. The findings further highlight how sensitive the stolen data is, and… Source Article Link: https://databreaches.net/2026/09/23/fbi-hack-exposed-fbis-own-hacking-unit/
-
update from deafnews.it
ShinyHunters claims breach of FBI data on agents and applicants in retaliation for IC3 report, denying swatting and sextortion allegations.
deafnews.it · 20d ago · September 24th, 2026
ShinyHunters claims breach of FBI data on agents and applicants in retaliation for IC3 report, denying swatting and sextortion allegations.
-
update from malware.news
Stolen FBI data reveals employees’ roles in intelligence and surveillance
malware.news · 20d ago · September 24th, 2026
Data stolen in a major hacking group’s alleged intrusion into FBI systems is believed to contain personal information on hundreds of FBI intelligence analysts and other employees involved in clandestine intelligence-gathering and surveillance, according to two people familiar with the matter. The analysts focus on myriad subject areas like Russia, China, Hezbollah and cartel-related intelligence, said the people, who spoke on the condition of anonymity because the exposures are sensitive. The employees’ roles only offer a small picture of their duties, but may still help outsiders identify people working in sensitive parts of the bureau. ShinyHunters claimed responsibility for the breach Monday, threatening to release what it described as two to three terabytes of FBI employee data unless the bureau retracted a public warning about its tactics within a week. On Tuesday, the group ShinyHunters claims FBI data theft, demands bureau retract cyber warning - Nextgov/FCW ”>sent Nextgov/FCW and other news outlets an apparent sample of that data containing roughly 5,000 entries listing employees’ names, home addresses, phone numbers and information about their spouses and siblings. Multiple individuals also wo
-
update from nytimes.com
Hackers Say They Stole Thousands of Sensitive F.B.I. Personnel Records
nytimes.com · 19d ago · September 24th, 2026
submitted by /u/Dances_With_Seagulls [link] [comments]
via reddit r/cybersecurity: Hackers Say They Stole Thousands of Sensitive F.B.I.
-
mentioned by threatnoir.com
⚠️ CRITICAL: ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants ShinyHunters claims successful breach of FBI sy
threatnoir.com · 19d ago · September 24th, 2026
-
update from www.bbc.com
This is such an enormous breach...so harmful... 😬 "The hackers, Shiny Hunters, say they now hold private data on all the bureau staff - arou
www.bbc.com · 19d ago · September 24th, 2026
This is such an enormous breach...so harmful... 😬 "The hackers, Shiny Hunters, say they now hold private data on all the bureau staff - arou
via Mastodon https://www.bbc.com/news/articles/c9n74574elljo
-
update from securityonline.info
Discover how the ShinyHunters hacking group claims to have orchestrated a massive FBI data breach, stealing employee records via an Oracle z
securityonline.info · 19d ago · September 24th, 2026
Discover how the ShinyHunters hacking group claims to have orchestrated a massive FBI data breach, stealing employee records via an Oracle z
via Mastodon https://securityonline.info/fbi-shinyhunters-data-breach/?utm_source=mastodon&utm_medium=jetpack_social
-
mentioned by arstechnica.com
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real
arstechnica.com · 19d ago · September 24th, 2026
-
mentioned by rbfirehose.com
Reuters: Hacked FBI data has sensitive information about employees’ intelligence roles. “The 5,000-line spreadsheet – said by the hackers to
rbfirehose.com · 19d ago · September 24th, 2026
-
mentioned by bbc.com
FBI investigating claim hackers have stolen details of all its agents
bbc.com · 19d ago · September 24th, 2026
-
mentioned by www.404media.co
# FBI Hack Exposed FBI’s Own Hacking Unit https://www. 404media.co/fbi-hack-exposed-f bis-own-hacking-unit-remote-operations-shinyhunters/ #
www.404media.co · 19d ago · September 24th, 2026
-
mentioned by arstechnica.com
# FBI rushes to investigate if # ShinyHunters hack of thousands of employees is real https:// arstechnica.com/tech-policy/20 26/09/fbi-rushe
arstechnica.com · 19d ago · September 24th, 2026
-
mentioned by www.404media.co
"The catastrophic hack of at least thousands of FBI officials’ personal data, including their addresses, phone numbers, and even their spous
www.404media.co · 19d ago · September 25th, 2026