{"id":1047,"date":"2026-09-23T20:20:47","date_gmt":"2026-09-23T20:20:47","guid":{"rendered":"https:\/\/localseobot.ai\/blog\/shinyhunters-fbi-oracle-peoplesoft-zero-day\/"},"modified":"2026-10-29T06:48:07","modified_gmt":"2026-10-29T06:48:07","slug":"shinyhunters-fbi-oracle-peoplesoft-zero-day","status":"publish","type":"post","link":"https:\/\/localseobot.ai\/blog\/shinyhunters-fbi-oracle-peoplesoft-zero-day\/","title":{"rendered":"ShinyHunters Claims FBI Data Theft Through Oracle PeopleSoft Zero-Day"},"content":{"rendered":"
Updated October 29, 2026 at 2:46 AM ET<\/em><\/div>\n

ShinyHunters claimed it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data on employees and job applicants. The FBI says it is investigating unauthorized activity affecting FBIjobs.gov, while Oracle and Google Cloud’s Mandiant had not confirmed the group’s claims when BleepingComputer reported the incident<\/a>.<\/p>\n

The Zero Day Initiative at Trend Micro later identified the vulnerability as CVE-2026-35273<\/a>. That later reporting adds important context, but several central details of the FBI incident remain attributed to ShinyHunters rather than independently confirmed by the FBI.<\/p>\n

What happened<\/h2>\n

ShinyHunters told BleepingComputer that it exploited a new Oracle PeopleSoft vulnerability on Monday night, gained access to internal FBI services and moved laterally into FBI-managed AWS GovCloud infrastructure. The group claims it stole between 2TB and 3TB of data involving current and former FBI employees, job applicants and other internal records.<\/p>\n

The FBI told BleepingComputer: The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.<\/q> The agency did not confirm whether its systems were breached or data was stolen, and BleepingComputer did not independently verify the alleged zero-day, lateral movement or volume of data.<\/p>\n

TrendAI’s Zero Day Initiative reported CVE-2026-35273 to Oracle on June 10, 2026, following an investigation with Minh Giang and Lucas Miller of TrendAI Research. Its later technical account said the vulnerability chain began with server-side request forgery and could reach endpoints vulnerable to remote code execution.<\/p>\n

Are you affected?<\/h2>\n

Organizations that run PeopleSoft should review whether their instances are exposed and whether they store employee, applicant or customer information.<\/p>\n

Oracle has issued a patch under a single CVE, according to the Zero Day Initiative, while working with Oracle to assign separate CVEs for three distinct vulnerabilities reported across multiple PeopleSoft components. The technical account identifies the PeopleSoft Environment Management Hub and another PeopleSoft component as separate Oracle WebLogic applications involved in the issue.<\/p>\n

The Zero Day Initiative also says Oracle introduced a validateClient<\/code> method to restrict access to certain PeopleSoft functionality. Local businesses should check their PeopleSoft inventory and ask whoever administers it whether CVE-2026-35273 and the related PeopleSoft components have been patched.<\/p>\n

The source does not state that the flaw affects local business websites or Google Business Profiles directly. For any business whose broader website or customer portal connects to a PeopleSoft environment, administrators should determine whether that relationship exists before changing public-facing services.<\/p>\n

What to do now<\/h2>\n
    \n
  1. Identify every PeopleSoft instance.<\/strong> Ask the administrator to inventory the organization’s PeopleSoft deployments, including instances associated with the PeopleSoft Environment Management Hub and other components covered by the Oracle advisory or Zero Day Initiative report.<\/li>\n
  2. Check the Oracle advisory for CVE-2026-35273.<\/strong> Confirm whether the relevant PeopleSoft software has been patched, and whether separate CVEs have since been assigned for the other reported issues.<\/li>\n
  3. Review public access and administrative logs.<\/strong> Look for unusual authentication activity, web requests, deployments and other access around the period described in the incident.<\/li>\n
  4. Review linked cloud access.<\/strong> For businesses with PeopleSoft-connected cloud environments, examine whether credentials, sessions or network access allowed movement beyond the application. The FBI case reportedly involved movement into AWS GovCloud, but the source does not identify the exact permissions or configuration involved.<\/li>\n
  5. Protect exposed PeopleSoft services while the review is under way.<\/strong> If the platform must remain online for business operations, ask the administrator to restrict unnecessary public access and confirm that Oracle’s access-control changes are applied. The Zero Day Initiative says the validateClient<\/code> method can restrict access to certain functionality.<\/li>\n<\/ol>\n

    What the group says it took<\/h2>\n

    ShinyHunters says the stolen data includes information about current and former FBI employees, job applicants and other internal records. It also claims that FBI Criminal Justice, HR, Medlink and other services were compromised during the intrusion.<\/p>\n

    A message displayed on the defaced FBI Jobs website claimed that sensitive personally identifiable and health-related information belonging to FBI employees and applicants had been taken. The message stated: All FBI data was compromised including sensitive PII\/PHI on incumbent and former FBI employees and all applicant information.<\/q><\/p>\n

    The group shared two sample records that it claimed came from the attack, including records allegedly associated with an FBI special agent and FBI Director Kash Patel. BleepingComputer did not publish the personal information and did not independently verify the records’ authenticity or source.<\/p>\n

    What evidence has been presented?<\/h2>\n

    ShinyHunters provided a screenshot showing the FBI Jobs website at apply.fbijobs.gov with the group’s Umbreon Pokemon logo and a message claiming the site had been seized. The site later displayed a maintenance message after affected systems were taken offline.<\/p>\n

    According to ShinyHunters, the FBI detected the intrusion quickly, took affected systems offline and terminated access to several FBI networks at the same time. 404 Media first reported the alleged breach after receiving a sample containing approximately 5,000 purported FBI employee records. That publication said it verified some information in the sample, including phone numbers matching people with the same names whose numbers were associated with US Department of Justice personnel.<\/p>\n

    How did the reported intrusion begin?<\/h2>\n

    ShinyHunters claims the initial access came through an unpatched Oracle PeopleSoft zero-day that the group found and immediately exploited against the FBI. It also says the group attempted to erase evidence from compromised servers to make the vulnerability harder to identify.<\/p>\n

    The later Zero Day Initiative technical report<\/a> provides more detail about the reported flaw. Its researchers found that the server-side request forgery could satisfy access validation and reach endpoints vulnerable to remote code execution. The report also says the Zero Day Initiative reported three distinct vulnerabilities across multiple PeopleSoft components, while Oracle initially issued a patch under one CVE.<\/p>\n

    Administrators should determine which PeopleSoft components their organization uses and which components its administrators exposed before deciding whether the available patch addresses their deployment.<\/p>\n

    Is this broader than the FBI?<\/h2>\n

    ShinyHunters says it has used the same alleged vulnerability against other organizations, including Fortune 500 companies, after earlier targeting the education sector. BleepingComputer contacted Oracle and Google Cloud’s Mandiant threat intelligence team about the reported vulnerability and exploitation activity when the original article was published.<\/p>\n

    Organizations that depend on PeopleSoft for human resources, recruiting or related workflows should review their exposure as soon as practical. Application monitoring and review of downstream cloud access can be relevant parts of that review.<\/p>\n

    Why ShinyHunters says it acted<\/h2>\n

    ShinyHunters published a statement on its data leak site saying the attack was retaliation for an FBI FLASH report about the group, which was published in May 2026. The group disputed claims that its actors exaggerate access, harass victims and relatives, conduct swatting attacks and falsely claim to possess compromising material.<\/p>\n

    It also denied membership in The Com, a loose-knit cybercrime community associated in reporting with data breaches and cryptocurrency theft. ShinyHunters gave the FBI one week to correct or remove the report while claiming that its demand was not financially motivated and was not extortion. The group declined to say whether it would release the alleged FBI data if the report remained unchanged, answering: No comment.<\/q><\/p>\n

    What should local business websites and Google Business Profiles check?<\/h2>\n

    The relevant review begins with whether the website, employee portal, recruiting system or another connected service relies on PeopleSoft.<\/p>\n

    Local businesses without PeopleSoft can use the incident as a prompt to inventory sensitive business applications and check that administrative access is limited. Businesses with PeopleSoft should involve the platform administrator, review the Oracle advisory and verify that the relevant patches and access restrictions are in place.<\/p>\n

    FAQ<\/h2>\n

    What does ShinyHunters claim happened to the FBI?<\/h3>\n

    ShinyHunters claims it exploited a new Oracle PeopleSoft zero-day, reached internal FBI services, moved laterally into FBI-managed AWS GovCloud infrastructure and stole between 2TB and 3TB of data involving employees, applicants and internal records.<\/p>\n

    Has the FBI confirmed the breach and data theft?<\/h3>\n

    The FBI confirmed that it is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is investigating. It has not confirmed whether its systems were breached or data was stolen.<\/p>\n

    What should organizations running Oracle PeopleSoft do?<\/h3>\n

    They should inventory their PeopleSoft instances, review Oracle’s advisory for CVE-2026-35273, confirm that relevant patches and access restrictions are applied, and review logs for unusual activity and possible movement into connected cloud environments.<\/p>\n

    BizScoreAI<\/h2>\n

    \"BizScoreAI,<\/a><\/p>\n

    BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the free listing check<\/a>.<\/p>\n

    This article reports on publicly available information from the sources listed below. We have no reason to believe it is inaccurate, but we have not independently verified every claim, and details may change as the story develops.<\/em><\/div>\n
    \n

    Sources<\/h2>\n