ShinyHunters Claims FBI Hack, Cites Personal Grievance Over Alleged Harassment Tactics
The notorious ShinyHunters group claims to have breached the FBI's jobs website, exfiltrated terabytes of employee data, and is demanding the agency retract statements accusing them of harassment.
The cybercriminal group ShinyHunters has claimed responsibility for a significant breach targeting the FBI's jobs website, asserting that the attack was not financially motivated but rather a response to alleged false statements made by the FBI regarding the group's tactics. A spokesperson for ShinyHunters stated that the primary objective was to compel the FBI to retract or correct statements made in a May 15th bulletin, which accused the group of using "harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting."
According to the group's claims, the intrusion was facilitated by exploiting a zero-day vulnerability in Oracle's PeopleSoft software, which allowed for remote code execution (RCE) on the compromised servers. Following the initial compromise, ShinyHunters reportedly defaced the FBI jobs webpage with a "This site has been seized by ShinyHunters" banner. At the time of reporting, the website was displayed as "currently down for maintenance."
Beyond defacing the website, ShinyHunters alleges that it successfully moved laterally from the compromised site to the FBI's managed servers within the AWS GovCloud environment. From these servers, the group claims to have exfiltrated a substantial amount of data, estimated to be between 2 to 3 terabytes, belonging to current, former, and prospective FBI employees. The spokesperson indicated that the stolen data encompasses information on "all FBI employees and applicants."
The compromised systems, as per ShinyHunters' assertions, include critical functions such as human resources, MedLink, and Criminal Justice Information Services (CJIS). Neither Oracle nor Amazon Web Services (AWS) immediately responded to inquiries regarding the alleged zero-day vulnerability or the data theft.
This incident marks a departure from ShinyHunters' typical modus operandi, which usually involves demanding multi-million dollar ransoms in exchange for not leaking stolen data. In this instance, the group explicitly stated that no ransom payment is being sought. Their demand is solely focused on the retraction of the FBI's previous statements, which ShinyHunters claims are untrue and damaging.
The FBI bulletin that ShinyHunters seeks to have retracted was issued shortly after the group claimed a breach of the ed-tech company Instructure's Canvas platform, which allegedly impacted hundreds of millions of students, teachers, and staff. The bulletin also warned that extortionists might falsely claim to possess sensitive or compromising information that does not exist.
ShinyHunters' spokesperson expressed a personal motivation behind the attack, stating, "I have been doing my very best to combat these allegations. And this is the best way to do it." This suggests a direct confrontation with the FBI's characterization of their operations, moving beyond purely financial motives to address reputational damage.
The implications of this breach, if confirmed, are significant, potentially exposing sensitive employee and applicant data within a major US law enforcement agency. The group's unusual motive and direct challenge to official statements highlight a new dimension in cybercriminal motivations and operational strategies.
The FBI is investigating the cyberattack claimed by ShinyHunters, which temporarily defaced the FBIjobs.gov website and allegedly exfiltrated sensitive data on nearly all FBI agents and applicants. ShinyHunters claims this attack is retaliation for a recent FBI public service announcement about the group, and they are demanding the removal of the PSA rather than a ransom payment.
This new report from Cyber Security News provides further technical details on the ShinyHunters alleged breach of the FBI's jobs site. It claims the group exploited an unpatched Oracle PeopleSoft vulnerability for remote code execution and lateral movement into AWS GovCloud, exfiltrating 2-3 TB of data. While the FBI is investigating, the bureau has not confirmed the technical specifics of the intrusion or the full scope of data compromised, though partial validation of a sample of 5,000 records has been reported by other outlets.
The cyber extortion group ShinyHunters has claimed responsibility for a breach of the FBI's jobs website, FBIjobs.gov, stating they exploited a zero-day vulnerability in Oracle PeopleSoft. The group alleges to possess sensitive data on nearly all FBI agents and job applicants, including information from Criminal Justice, HR, and Medlink services. ShinyHunters stated this action was a response to an FBI public service announcement that they claim contained "substantial false allegations" and disinformation regarding their operations.
The threat group ShinyHunters has escalated its claims against the FBI, alleging a breach via a zero-day vulnerability in Oracle's PeopleSoft enterprise software. This new claim follows their previous assertion of hacking the FBI's jobs website and is reportedly motivated by a desire to force the FBI to retract a public service announcement that criticized ShinyHunters' tactics. The group has shared a sample of data allegedly containing personal information on 5,000 FBI employees, stating their goal is not financial gain but to compel the FBI to amend its public statement.
The ShinyHunters group has escalated its dispute with the FBI, explicitly denying accusations of swatting, sextortion, and involvement with 'The Com' group. They claim the FBI's FLASH report contained false allegations and that their actions are a defense of their reputation, not financially motivated. ShinyHunters has also threatened journalists they accuse of spreading disinformation about their operations.
The FBI has confirmed it is investigating the alleged breach of its jobs site, FBIjobs.gov, by the ShinyHunters group. The attackers defaced the site with a Pokemon graphic and claimed to have stolen information on current and former employees and applicants, threatening to leak data if the FBI did not remove a public service announcement critical of the group. Samples of stolen FBI agent records were provided to media outlets and confirmed as legitimate.
The cyber extortion group ShinyHunters claims to have breached FBI systems, exfiltrating over two terabytes of sensitive employee and applicant data. The group stated the hack was in retaliation for the FBI's public statements regarding their alleged harassment tactics, demanding the agency retract these claims. While the FBI is investigating, security experts suggest this high-profile claim may serve as a brand-building exercise for ShinyHunters, aiming to bolster credibility with potential future victims.
The threat group ShinyHunters has provided further details to The Register, asserting that their breach of the FBIJobs.gov portal was a strategic move to counter the FBI's own public statements. They claim the hack was a 'public relations and marketing initiative' designed to demonstrate their technical prowess and refute allegations of using harassment tactics, as outlined in a previous FBI FLASH report. The group stated they did not demand ransom, but rather sought to establish credibility with potential future 'corporate partners' by showcasing their capabilities.
The FBI's job applicant portals have been offline following a claimed breach by the ShinyHunters group, who allege they exploited an unspecified Oracle PeopleSoft zero-day vulnerability. This incident is part of a broader campaign by ShinyHunters to exploit CVE-2026-35273, a vulnerability they previously used against academic institutions. The group has adapted its exploit to bypass Web Application Firewall (WAF) rules by URL-encoding a single character, demonstrating an ability to circumvent common defensive measures.
The threat group ShinyHunters has escalated its claims regarding the FBI breach, asserting that its motive is not financial extortion but a personal vendetta to refute FBI statements about its operations. The group specifically disputes affiliations with "The Com," denies conducting swatting attacks, and refutes claims of possessing compromising material. ShinyHunters has set a deadline for the FBI to retract or amend its public service announcement, a demand that researchers find unusual and potentially self-incriminating for the group.
The FBI and Dutch police have announced the arrest of an alleged leader of the ShinyHunters cyber-extortion group, identified as 24-year-old Pepijn van der Stap. While Dutch authorities did not publicly name the suspect, sources identified him as the offensive security lead for Neo Security. The arrest follows ShinyHunters' recent claim of compromising FBIJobs.gov, potentially exposing sensitive personnel and applicant data, though the FBI has not fully validated the extent of the breach.
Following the arrest of an alleged leader of the ShinyHunters gang in the Netherlands, the FBI has issued a direct warning to the remaining members. Assistant FBI Cyber Chief Brett Leatherman stated that law enforcement has seized infrastructure and made arrests that reveal who is still active, urging criminals to surrender. The FBI's message comes after ShinyHunters claimed responsibility for hacking the FBI jobs portal, asserting the motive was to correct perceived false statements by the agency rather than financial gain.
The detention of Saif al-Din Khader, a suspected ShinyHunters member, in Jordan and his reported cooperation with the FBI marks a significant development in the ongoing investigation into the alleged FBI data breach. Khader's alleged online alias is Rey, and sources indicate he is assisting law enforcement in identifying other members of the ShinyHunters group. This follows previous arrests made with international partners, underscoring a coordinated effort to dismantle the hacking collective.
The detention of Saif al-Din Khader, known online as "Rey," in Jordan marks a significant development in the ongoing investigation into the ShinyHunters group. Khader, allegedly a key administrator for the group and its predecessors, is reportedly cooperating with the FBI to identify other members. This follows recent actions against other alleged ShinyHunters associates and the group's own high-profile hacks, including one targeting the FBI's jobs portal.
Jordanian authorities have detained Saif al-Din Khader, also known as Rey, a suspected member of the ShinyHunters group. Khader is reportedly cooperating with the FBI, providing access to his electronic devices and digital communications, which is considered crucial for apprehending other members of the group. This development follows the FBI's earlier statement about arresting multiple subjects in connection with the ShinyHunters cyber incident.
The FBI has confirmed multiple arrests in connection with the ShinyHunters data-theft group, including the detention of alleged member Saif al-Din Khader in Jordan and the arrest of Pepijn van der Stap, described as a ShinyHunters leader, by Dutch police. These actions follow ShinyHunters' hack of FBIJobs.gov and come as the FBI continues its investigation into the group's activities, including the Jaguar Land Rover breach.