FBI Investigates ShinyHunters' Claim of Hacking Thousands of Employee Records
Hacking group ShinyHunters claims to have stolen data on thousands of FBI employees via a zero-day flaw in Oracle PeopleSoft software and gave the bureau's leadership a one-week deadline to meet its demands. The FBI has begun investigating the claims but has not confirmed a breach occurred.
The hacking group ShinyHunters claims to have obtained personal data belonging to thousands of FBI employees and has given the bureau's leadership a one-week deadline to meet its demands. According to reports, the group contacted FBI Director Kash Patel and Assistant Director of the FBI Cyber Division Brett Leatherman directly, warning of a possible leak of sensitive employee data if its demands go unmet.
Few details on how the breach happened
Little has been publicly disclosed about how ShinyHunters gained access. The group told The New York Times only that it had exploited a zero-day — a previously undiscovered software flaw — in Oracle PeopleSoft, an application widely used by organizations for human resources and financial management. Oracle has not commented on the reported vulnerability, while ShinyHunters said it intends to keep using the flaw for its "businesses' normal operations."
FBI urges employees to take precautions
The FBI has not confirmed that a breach actually took place, though it has opened an investigation into the claims. In a Wednesday post on X, the bureau said it remains undetermined whether the point of breach originated with a third party or within the FBI's own systems. The agency said it is "actively and aggressively investigating" the matter and working closely with third-party providers supporting its jobs website to mitigate any risk.
As of Wednesday, that jobs site remained inaccessible. Sources inside the FBI told Bloomberg that all personnel received an email urging them to take steps to protect themselves while the investigation continues.
Possible data leak looms
ShinyHunters has not said what would happen if the FBI fails to meet the deadline, though cybersecurity experts told The New York Times the data would most likely end up leaked online. The group insisted its actions are not financially motivated and that it is not extorting the bureau, stating its sole goal is to "set the record straight."
