Story perspectives

FBI Warns ShinyHunters After PeopleSoft Data Breach

By Drooid · Sep 29, 2026, 11:32 PM UTC · How we work

Summary

FBI Warns ShinyHunters

FBI Assistant Director Brett Leatherman warned ShinyHunters on X that the bureau can locate them.
A breach of FBIJobs.gov exposed medical records, Social Security numbers, family data and intelligence details of staff.
Dutch police arrested 24-year-old Pepijn van der Stap on September 15.
FBI Director Kash Patel thanked Dutch authorities for the arrest.
ShinyHunters said it would not publish stolen data, gave a one-week deadline, and released a 5,000-line sample of personal information.

Summary

CISA Flags PeopleSoft

ShinyHunters revived exploitation of Oracle PeopleSoft by URL-encoding “/PSEMHUB” to bypass WAF rules.
The group now targets systems worldwide in technology, healthcare, agriculture, transportation, and government sectors.
Oracle’s patch for CVE-2026-35273, released June 10 2026, still mitigates the underlying flaw.
CISA added the vulnerability to its KEV catalog on June 12 2026, giving federal agencies three days to patch.
Mandiant advises disabling the PeopleSoft Environment Management Hub service or removing the PSEMHUB application entirely.

History

Historical Context

In November 2013, hackers breached Target by stealing credentials from HVAC contractor Fazio Mechanical Services and deploying BlackPOS malware on point-of-sale systems in roughly 1,800 U.S. stores. The incident exposed about 40 million credit and debit cards and prompted agencies such as the FBI and later CISA to focus on coordinated, supply-chain defenses, a response underscored by 2020 data showing organized crime behind 55 % of breaches.

1 of 3

FBI Warns ShinyHunters

FBI Assistant Director Brett Leatherman warned ShinyHunters on X that the bureau can locate them.
A breach of FBIJobs.gov exposed medical records, Social Security numbers, family data and intelligence details of staff.
Dutch police arrested 24-year-old Pepijn van der Stap on September 15.
FBI Director Kash Patel thanked Dutch authorities for the arrest.
ShinyHunters said it would not publish stolen data, gave a one-week deadline, and released a 5,000-line sample of personal information.

1 / 3