FBI investigating claims of a PeopleSoft breach and theft of agent and applicant data, BleepingComputer reports
BleepingComputer reported on 22 September 2026 that a group calling itself ShinyHunters claimed it breached FBI systems using an alleged Oracle PeopleSoft remote-code-execution zero-day and stole employee and applicant data.
BleepingComputer says the group shared a screenshot of apply.fbijobs.gov allegedly defaced with its Umbreon logo, and that the jobs and special-agent portals later showed maintenance.
According to BleepingComputer, 404 Media reported receiving a sample of agent names, home addresses and phone numbers (including spouses) and verifying a portion against public records; TechCrunch also relayed the claim.
BleepingComputer states it has not independently verified the alleged zero-day, lateral movement, or volume of stolen data.
UPDATE 26 Sep 2026: BleepingComputer reports the FBI confirmed it is investigating the claims without confirming a breach or data theft.
A separate Google Mandiant/GTIG report the same week documents renewed UNC6240 mass exploitation of already-patched CVE-2026-35273 (PeopleSoft PeopleTools PSEMHUB); that campaign is covered on /n/cve-2026-35273, and it is unclear whether the FBI claim is that CVE or a distinct flaw. (sources: BleepingComputer; TechCrunch)
Correction (06 Nov 2026): re-issued under a neutral id and removed the group's claim from the title; the card gives it only in the credited sentence above. (source: BleepingComputer)
- Product
- Alleged Oracle PeopleSoft (HR/applicant) → FBI-managed AWS GovCloud / FBI Jobs (apply.fbijobs.gov)
- Exploited in Australia?
- unknown
- Patch to
- Patch internet-facing PeopleSoft HR and applicant portals for CVE-2026-35273 and every later Oracle Critical Patch Update now, and do not rely on a WAF rule alone, since ShinyHunters is bypassing one with URL encoding. If a contractor or managed-service provider runs the platform, make patch deadlines and evidence of applied patches part of the contract and check them yourself. Keep MFA, exposure review and monitoring for PeopleSoft exploitation patterns in place, and rotate credentials if you share the same stack.