Some breach headlines make you roll your eyes. Others make you stop and read the whole thing twice. On Tuesday, September 22, visitors to FBIjobs.gov were greeted with a message reading "This site has been seized by ShinyHunters."
According to 404 Media, the group's claim was about as blunt as it gets: "We hacked the FBI. We hold data on all FBI employees and applicants."
Yes, the same ShinyHunters behind the Madison Square Garden leak back in June. And the Instructure Canvas data breach. They've had a busy year.
Before going further, a caveat. Most of what we know right now comes from the attackers themselves. The FBI has said only that it "is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."
It has not confirmed that any data was taken. Still, the details that have come out so far are worth looking at closely, because the way this reportedly happened should feel very familiar to anyone who runs security for a company.
What ShinyHunters Is Claiming
Based on reporting from 404 Media, BleepingComputer, SecurityWeek and Axios, here is what the group says it did:
- Got in through Oracle PeopleSoft. The group says it used a previously unknown PeopleSoft vulnerability that allows remote code execution. SecurityWeek noted it may be CVE-2026-35273, a PeopleSoft flaw ShinyHunters was already confirmed to be exploiting back in June. That link hasn't been confirmed.
- Moved laterally into AWS GovCloud. From there, the attackers say they reached FBI-managed cloud infrastructure and pulled down 2 to 3 terabytes of data from the Bureau's Criminal Justice, HR and Medlink services.
- Covered their tracks. They claim they tried to wipe evidence to hide how the zero-day works, and that they're now using the same flaw against Fortune 500 companies.
To back this up, the group handed 404 Media a sample of 5,000 employee records containing names, home addresses, phone numbers, dates of birth and spouse information. Axios reported that some of the spouse data includes Social Security numbers. 404 Media checked some of the phone numbers against other sources, and several appeared to be real.
"Not Extortion, Maybe Coercion"
The motive is where this one gets strange. ShinyHunters says the attack isn't about money. It's retaliation for an FBI FLASH report from May that described the group's tactics, including exaggerating what they've stolen and harassing victims with things like swatting.
The group wants the FBI to correct or pull that report within a week. Their own description of the demand: "not extortion, maybe coercion."
So the group accused of pressuring victims with stolen data is pressuring the FBI with stolen data to say it doesn't do that. I'll let that sit for a second.
Former FBI cyber official Cynthia Kaiser told CyberScoop that going after law enforcement like this "demonstrates a lack of discipline that historically has led to takedowns." She's probably right. But a future arrest doesn't do much for the agents whose home addresses are now sitting on a criminal forum.
The Accenture Connection
Update: October 7, 2026
Two weeks on, part of this story has moved from claim to confirmed fact — and part of it hasn't. The entry point really was Oracle PeopleSoft, exactly as ShinyHunters said, though it turns out to have been a known, patchable CVE rather than the mystery zero-day originally described — exploited only because a contractor never applied an available patch.
What the FBI still hasn't confirmed, even now, is the scope of what was actually taken. The claimed 2–3 terabytes, the specific pull from Criminal Justice, HR, and Medlink systems, and the "almost all FBI employees and applicants" framing all remain ShinyHunters' account of events, not the Bureau's. The FBI has acknowledged an incident occurred. It has not said how much data left.
According to Reuters and The Hacker News, the FBI has removed an Accenture contractor it holds responsible for the incident. Brett Leatherman, assistant director of the FBI's cyber division, told Reuters that "our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform." The FBI didn't name the platform, but Reuters' sources confirmed it's Oracle PeopleSoft — the same system ShinyHunters claimed to have exploited.
That detail changes the story we told above. This wasn't an unknown flaw nobody could have caught. Reporting from Mandiant indicates ShinyHunters got in through a WAF bypass for CVE-2026-35273 — a URL-encoding trick that slipped past a firewall rule written specifically to block the vulnerable Environment Management Hub (PSEMHUB) endpoint. A patch existed. A compensating rule existed. Neither worked, because the patch was never applied.
If you run PeopleSoft, or any enterprise platform where patching is somebody else's job, this is the part to sit with: a WAF rule is not a substitute for patching, and a contractor's missed task can become a federal law enforcement agency's breach notification two months later.
Accenture, for its part, told Reuters it remains "proud to support the mission of the FBI and will continue to do so."
Did the FBI blink on the FLASH report? No.
ShinyHunters' one-week deadline to correct or retract the May advisory came and went with it unchanged. The group never published the stolen employee data either, later telling Cybernews it "never intended to nor have we ever planned to" release it — reframing the whole episode as "a marketing campaign to protect our business and actively combat disinformation." Leatherman's response, delivered in a public video on September 29, was characteristically blunt: get in touch with the FBI "while the choice is still yours."
The arrests have started.
That warning wasn't idle. Dutch authorities arrested a 24-year-old Amsterdam man in mid-September on suspicion of involvement with ShinyHunters — described by FBI Director Kash Patel as "one of the alleged leaders" — with a Rotterdam court ordering 90 days of detention while the investigation continues.
A second member, reported as going by "Rey," has also reportedly been arrested. The FBI says the group has compromised more than 140 organizations and extorted roughly $70 million to date, and that more arrests are likely.
None of this undoes the exposure of thousands of FBI employees' and applicants' personal data. But it does answer the two questions we left open above: no, the FBI didn't cave — and yes, the "lack of discipline" Cynthia Kaiser predicted would lead to takedowns is already playing out.
Why the HR Stack Keeps Getting Hit
Take the FBI out of the story and look at the path. An enterprise HR application with a flaw nobody knew about. A connection from that application into cloud infrastructure. A huge pile of personal data sitting where the attacker landed. None of that is unique to a federal agency. Plenty of mid-sized companies are set up the exact same way.
HR systems are some of the most valuable targets in any organization, and they tend to get less attention than they should. Think about what lives in them: home addresses, Social Security numbers, bank details, background checks, medical and benefits information, performance notes, family members.
For an agency like the FBI, add one more thing. A list of people with security clearances, where they sleep at night, and who they're married to is a gift to anyone doing social engineering or worse.
And then there are the applicants. Most people who apply for a job with the FBI never end up working there. Their data was still apparently sitting in these systems, waiting. We saw the same thing with MSG, where years of retained data ended up in a public dump. If you don't need it anymore, it shouldn't be there. Data you've deleted can't be stolen.
The Blast Radius Problem
The detail I keep coming back to is the lateral movement. A vulnerability in a single application is bad. A vulnerability in a single application that leads straight into your cloud environment, and then into multiple unrelated services, is a very different problem.
A few questions every security team should be asking right now:
Do you know what your HR platform is connected to? Integrations, service accounts, API keys and cloud roles pile up over years. Each one is a possible bridge for someone who gets a foothold in one system.
How much access do those connections actually have? If a job portal can reach criminal justice or medical data, something went wrong well before any attacker showed up. Service identities should be scoped to what they need and nothing more.
Would you notice 2 or 3 terabytes leaving? That's not a quiet trickle. Bulk data movement from systems that don't normally move bulk data should set off alarms right away, not show up in a report next quarter.
How long do you keep applicant and former employee data? Set retention rules and enforce them automatically. Leaving this to manual cleanup means it won't happen.
Are you patching the "boring" enterprise apps as fast as the exciting ones? PeopleSoft doesn't get headlines, but it runs payroll and HR at thousands of organizations. If ShinyHunters really is turning this flaw on private companies, the window to check your exposure is now.
What Comes Next
We'll learn a lot more over the next few weeks. More updates have already been coming through.
Whatever the final numbers look like, the takeaway for everyone else is already clear. The most sensitive data most organizations hold isn't in a vault somewhere. It's in the HR system, it's connected to a lot more than people realize, and it's often been there far longer than it needs to be.
If one of the most security-conscious organizations in the country can be exposed through a job portal, it's worth taking a hard look at your own.
.png){kind=small}
