WASHINGTON, September 25 — The cybercriminal group ShinyHunters says it has stolen personnel data from the FBI, and the bureau’s own recruitment portal has been offline for much of the week. The claim, posted on the dark web and repeated in exchanges with multiple media outlets, concerns data on FBI and Justice Department workers. The FBI has not confirmed a breach.
The group says it took data related to FBI personnel and job applicants, and attributes the intrusion to a new vulnerability in Oracle PeopleSoft, the human resources management software the bureau’s recruiting arm is documented as using. FBI documents confirm that recruiting operation also runs on AWS GovCloud.
The technical reality of a PeopleSoft compromise is unremarkable in itself — the platform is widely deployed across government and higher education, and its exposure surface is well understood by the people who spend their time looking at it. What matters is whether the data came out of FBI systems or a third party’s.
The claim, and the portal
On Monday, September 21, ShinyHunters claimed the breach, saying it had taken data related to FBI and Justice Department workers. RansomLook, an open-source ransomware intelligence archive that monitors data leak sites, captured and archived two statements posted under the ShinyHunters identity concerning the claimed FBI breach. By Tuesday, September 22, the group had posted a message addressed to FBI Director Kash Patel and FBI Cyber Division Assistant Director Brett Leatherman.
“We have compromised the FBI,” it read. The group said it held sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs, and listed criminal justice, human resources and Medlink systems among the affected services.
That same Tuesday, the home page for FBI careers carried a “System Unavailable” message. “Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable,” it read. “For urgent scheduling issues, please reach out to your Applicant Coordinator.
We apologize for the inconvenience.” The FBI said Tuesday it was aware “of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” On Wednesday, September 23, the agency offered a more detailed statement. “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” it said.
“While the point of breach is still undetermined — whether a third party or the FBI’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.”
A shifting ecosystem, and an old argument
ShinyHunters has been active since at least 2020. Security researchers treat it not as a single, fixed entity but as a shifting ecosystem of threat actors — which is precisely the sort of ambiguity that makes attribution a slog. The group is widely known for large-scale data and cloud theft.
In its post saved by RansomLook, ShinyHunters complained about an FBI FLASH report issued during the second quarter of this year and disputed the bureau’s characterization of the group and its tactics. The FBI, the group said, had suggested ShinyHunters sometimes exaggerates access, harasses victims or relatives, participates in swatting and falsely claims to possess compromising material.
ShinyHunters denied that its demands are financially motivated and rejected descriptions of its actions as ransom, coercion or extortion. It gave the FBI a deadline of one week to “correct or remove” portions of the earlier FLASH report. The bureau has been warning about this ecosystem for months.
In May, it issued two alerts. A May 8 FLASH bulletin described the group’s methods — stolen credentials, abuse of trusted vendor and cloud relationships, data theft and extortion sometimes involving harassment.
A week later, an Internet Crime Complaint Center advisory cautioned that actors using the ShinyHunters name may make real or exaggerated claims of access, threaten victims and relatives, engage in swatting and falsely allege they hold compromising material to pressure targets. Both warnings advised organizations not to pay or engage with their demands. Under the hood, the PeopleSoft angle has precedent.
From May 25 through June 9 this year, Google documented ShinyHunters exploiting a different Oracle PeopleSoft zero-day vulnerability. CBS News has reached out to Oracle for comment. This is at least the third potentially major cyber incident to impact the FBI.
The detail that matters now is the one the bureau itself flagged: whether the point of breach sits with a third-party provider or inside its own enterprise. Watch for the outcome of that determination, and for whether the recruitment portal comes back cleanly.
