Hacking group says an unpatched PeopleSoft flaw gave it FBI employee data

The criminal group ShinyHunters claims it broke into FBI systems by exploiting a vulnerability in Oracle PeopleSoft that is neither publicly known nor fixed. According to the group it achieved code execution on a server, moved on into FBI managed infrastructure in AWS GovCloud and downloaded between two and three terabytes. The haul is described by the group as personal and health information on current and former employees, and on everyone who has applied for a job with the bureau. During the intrusion the group also claims to have compromised FBI Criminal Justice, HR and Medlink, and, in its own words, additional services. The group says the records came from systems it reached after the initial PeopleSoft compromise, among them the FBI's own AWS GovCloud environment, which was used to store employee and applicant information. As its motive the group gives revenge for an FBI notice about itself, published on 15 May 2026, and it has given the bureau one week to withdraw that notice before the data is released. Images on the FBI jobs website were replaced on 22 September 2026, and the applicant portal at apply.fbijobs.gov afterwards showed a maintenance message.

The FBI confirms that it is aware of claims of unauthorised activity affecting FBIjobs.gov and that it is investigating. Where the intrusion happened has not been established: the bureau says the point of breach may lie with a third party or in its own enterprise, and that it is working with the providers behind the portal. 404 Media, which reported the story first, received a sample from the group. According to Infosecurity Magazine the sample apparently held information on 5000 FBI employees, including addresses, telephone numbers, dates of birth and in some cases details about spouses. NBC News reports that a former FBI agent confirmed one of the documents as genuine. BleepingComputer states that it has not verified the vulnerability, the lateral movement or the amount of stolen data, and NBC News writes that the extent of the claims could not be verified. Infosecurity Magazine, by contrast, writes that an FBI spokesperson described that very chain to 404 Media, meaning the flaw, the move to AWS GovCloud and the two to three terabytes, while the FBI's own statement says the point of breach is still undetermined.

No identifier exists for the new flaw. Oracle's alert index has carried no new security alert since the one covering CVE-2026-35273. BleepingComputer has put the question of a new PeopleSoft vulnerability to Oracle and to Mandiant, and says it will update its story if an answer arrives. CISA has no new PeopleSoft entry in its catalogue of exploited vulnerabilities either. The only entry there is that same CVE-2026-35273, which Oracle disclosed on 10 June 2026 and CISA catalogued two days later with a 15 June deadline. That flaw affects PeopleTools 8.61 and 8.62, sits in the Updates Environment Management component, allows code execution over HTTP without authentication and scores 9.8 out of 10 for severity. Steve Povolny of Exabeam notes that ShinyHunters exploited a flaw in that same component against more than 100 organisations in May and June, most of them universities, and that the group said afterwards its real target had been an FBI PeopleSoft server. That attempt failed at the time, and Povolny describes the universities as collateral damage from a shot at the bureau that never landed. His advice to anyone running PeopleSoft is to confirm that the fix for the earlier flaw is actually applied, disable the Environment Management Hub or remove the PSEMHUB application, take the PeopleSoft administration and integration interfaces off the internet, and hunt in the logs rather than wait for a signature that does not yet exist. He points to suspicious POST activity in the WebLogic access logs, unauthorised files in the PSEMHUB directories and outbound traffic on port 445, and says logs belong off the host, since the attackers themselves claim they wipe local evidence.

What this means for you if you run PeopleSoft

If you have PeopleSoft in production, there are two things worth not waiting for. One is confirmation from the FBI, which will arrive when the investigation ends rather than when you need it. The other is a vulnerability identifier, because the group says it is already turning the same flaw on large companies. Our assessment is that your environment should be treated as exposed now, whether or not the FBI claim holds up. What matters is not who was hit earlier this week. Povolny puts at more than 100 the organisations hit through a flaw in that same update component in May and June, and in our view that figure says more about how exposed the component is than any single incident does.

Then there is the question of what a personnel system actually holds. Povolny describes this as systematic mining of enterprise platforms carrying staff, payroll, applicant and health records, and that description fits a fairly ordinary PeopleSoft deployment. Employees and job applicants never chose to be in there, and they cannot take their records elsewhere. If it goes wrong on your side, this is not merely an operational matter: it is a privacy incident with deadlines, notification duties and people who have to be told. Note too that the FBI leaves open the possibility that the way in was through a third party. If you have outsourced operations or integrations around the personnel system, that question belongs to your provider just as much as to you.

Berigo recommends

• Map what your personnel system actually holds about employees and job applicants, and how long applicant records stay there after the post has been filled.
• Bring the personnel system into ordinary vulnerability management, and require a written answer on which version runs, when it was last updated and which interfaces are reachable from outside.
• Put the same questions to the provider that runs or integrates with the system: who can sign in to the server, how are you notified, and how quickly do you get an answer outside office hours.
• Decide now who speaks to your employees if someone claims publicly that personnel data from your organisation has been stolen. Establish at the same time what deadlines privacy law sets for notification.
• Rehearse an incident where the claim arrives first and the confirmation late, so that the decision to disconnect, close off access and rotate keys, passwords and tokens does not wait for a vulnerability identifier.