Story perspectives

ShinyHunters Extortion Threatens FBI Data Leak After Oracle Breach

By Drooid · Sep 23, 2026, 12:11 AM UTC · How we work

Summary

ShinyHunters Threatens Leak

ShinyHunters exploited an unknown Oracle PeopleSoft zero-day to run code on the FBI jobs portal.
The flaw enabled lateral movement into FBI servers on AWS GovCloud.
ShinyHunters gave the FBI one week to act before threatening a data leak.
The extortion note demands the FBI retract a May 15 public service announcement with alleged false statements.
ShinyHunters warned it will reuse the PeopleSoft zero-day against other targets, including schools.

Summary

ShinyHunters Breaches FBI

ShinyHunters claims it breached the FBI and stole data on thousands of agents.
The group said it struck the FBI after a May 2026 warning against paying.
Reuters verified nine records by matching names and addresses to credit-bureau data.
The sample reportedly includes about 5,000 entries with personal and spouse information.
ShinyHunters said the breach was not financially motivated and demanded removal of a report.

History

Historical Context

In 2015 Chinese-linked hackers breached the Office of Personnel Management, exfiltrating roughly 22 million federal personnel records and spurring agency-wide cybersecurity reforms. The breach highlighted the risk of unpatched enterprise software, a weakness echoed in the 2026 ShinyHunters attack that used an Oracle PeopleSoft zero-day to compromise the FBI’s AWS GovCloud portal, prompting a May 15 extortion deadline.

1 of 3

ShinyHunters Threatens Leak

ShinyHunters exploited an unknown Oracle PeopleSoft zero-day to run code on the FBI jobs portal.
The flaw enabled lateral movement into FBI servers on AWS GovCloud.
ShinyHunters gave the FBI one week to act before threatening a data leak.
The extortion note demands the FBI retract a May 15 public service announcement with alleged false statements.
ShinyHunters warned it will reuse the PeopleSoft zero-day against other targets, including schools.

1 / 3