ShinyHunters Claims FBI Breach Through PeopleSoft Zero-Day

ShinyHunters claims it breached FBI systems through an unpatched Oracle PeopleSoft vulnerability and stole employee and applicant data. The FBI says it is investigating claims of unauthorized activity affecting FBIjobs.gov.

The alleged ShinyHunters FBI breach remains unconfirmed. The FBI has not said whether attackers accessed its systems or stole data. Investigators have also not confirmed the claimed PeopleSoft zero-day.

ShinyHunters Claims Access to FBI Systems

ShinyHunters told BleepingComputer it used a PeopleSoft vulnerability to gain access on Monday night. The group claims it then moved into other FBI services, including an AWS GovCloud environment.

According to the group, the intrusion exposed between 2TB and 3TB of data. It says the material includes records on current and former employees, job applicants and internal operations.

BleepingComputer could not independently verify the alleged vulnerability, movement between systems or volume of stolen data. Consequently, those details remain claims from the attackers.

FBI Investigates Activity Affecting Jobs Website

The FBI confirmed that it knows about claims involving unauthorized activity at FBIjobs.gov and is investigating. Its statement did not confirm a broader breach or data theft.

ShinyHunters shared a screenshot that appeared to show a defaced FBI Jobs application site. The group also provided two records it claims came from the intrusion. BleepingComputer said it could not verify their authenticity or source.

Separately, 404 Media reported receiving a sample of roughly 5,000 purported FBI employee records. It said it verified that some details in the sample were accurate. That finding does not establish where the records came from or confirm ShinyHunters’ account of the intrusion.

Alleged PeopleSoft Zero-Day Remains Unverified

ShinyHunters says the alleged PeopleSoft flaw allows remote code execution and remains unpatched. The group also claims it is using the same vulnerability against other organizations, including large corporations.

Neither the vulnerability nor those additional attacks had been independently confirmed in the supplied report. BleepingComputer contacted Oracle and Google Cloud’s Mandiant team for information about the claims.

A confirmed zero-day would have implications beyond this incident. For now, however, organizations should distinguish the group’s description of its attack from findings that investigators or the software vendor have verified.

Group Links Its Claims to FBI Report

ShinyHunters later said the alleged attack was retaliation for an FBI report about the group published in May. It demanded that the agency change or remove the report within one week.

The group did not say whether it would release the purportedly stolen data if the FBI declined. Meanwhile, the FBI’s investigation continues, and the scope of any unauthorized activity remains unclear.