ShinyHunters says it hacked the FBI’s jobs website, defaced it, and stole 2 TB to 3 TB of data tied to current, former, and prospective FBI employees. According to the group, the intrusion used an unpatched Oracle PeopleSoft pre-authentication remote-code-execution zero-day on the FBI jobs portal, then moved into FBI-managed AWS GovCloud systems; the claims were not confirmed by the FBI, Oracle, or AWS at publication.
BrianKrebs
2026.10.19
82% relevant
This article adds investigative follow-up on the same FBI jobs-site/ShinyHunters incident, including that U.S. investigators suspect a ransomware negotiator helped operate a ShinyHunters extortion site and that seized Signal chats showed awareness of the FBI data theft before public threats.
Eduard Kovacs
2026.10.06
97% relevant
This directly updates the same FBI jobs-site breach by adding that Reuters sources identify the affected platform as Oracle PeopleSoft, the third-party operator as Accenture, and the FBI’s current finding that a contractor failed to apply an explicitly issued security patch.
2026.10.05
89% relevant
The article directly updates the same late-September FBIJobs.gov/ShinyHunters incident by adding that the FBI says it has already arrested multiple suspects in that investigation, including reporting around suspected member Saif al-Din Khader and an earlier Dutch arrest of an alleged ShinyHunters leader.
Ionut Arghire
2026.10.05
83% relevant
This article adds that Reuters reports an alleged ShinyHunters leader, Saif al-Din Khader ('Rey'), was arrested in Jordan and is reportedly cooperating with the FBI shortly after the FBIJobs.gov defacement and claimed theft of 2-3 TB of employee data.
Lawrence Abrams
2026.10.03
93% relevant
This directly advances the same underlying event: the FBI-focused ShinyHunters intrusion and ensuing crackdown. It adds that a suspected member known as Rey was reportedly detained in Jordan, is allegedly cooperating with the FBI, and that ShinyHunters infrastructure briefly went dark before a new leak site appeared.
Ionut Arghire
2026.09.30
88% relevant
This is a direct update on the same FBIJobs.gov incident, adding the FBI’s public response, the Netherlands arrest of an alleged ShinyHunters leader, and the group’s statement that it never intended to publish the allegedly stolen FBI employee data.
Lawrence Abrams
2026.09.29
74% relevant
This article adds the FBI’s public response after the claimed PeopleSoft-based FBI breach, tying it to the recent Dutch arrest of an alleged ShinyHunters leader and adding broader attribution details: more than 140 victim organizations since last year and at least $70 million in extortion payments.
2026.09.29
94% relevant
This advances the same underlying event by adding the FBI's public response to the FBIJobs.gov breach, confirming Dutch police arrested a suspected ShinyHunters leader with FBI assistance, seized devices, and are pursuing additional leads after the intrusion.
Ionut Arghire
2026.09.29
82% relevant
This report directly updates the FBI jobs-site breach by saying Dutch investigators arrested a suspected ShinyHunters associate and that Krebs tied the FBI hack, including the Umbreon-themed defacement, to that suspect, with the compromise likely using a modified CVE-2026-35273 exploit.
2026.09.25
96% relevant
This article directly updates the same FBIJobs.gov incident by adding FBI confirmation that it is investigating the breach claim, additional detail that the portal remains down, that ShinyHunters says it used another Oracle PeopleSoft zero-day and then accessed managed servers on AWS GovCloud, and the attackers' stated motive for the intrusion.
2026.09.23
97% relevant
This directly updates the same FBIjobs.gov breach by adding FBI confirmation that it is investigating the incident, details on the defacement of the jobs site, continued portal disruption, and reporting that samples of 5,000 stolen FBI agent records were validated by news outlets.
Eduard Kovacs
2026.09.23
99% relevant
This article is a direct update on the same claimed intrusion: ShinyHunters says it hacked FBI systems via Oracle PeopleSoft, defaced an FBI jobs subdomain, shared a sample of alleged FBI employee data with reporters, and tied the incident to its dispute over an FBI FLASH report.
info@thehackernews.com (The Hacker News)
2026.09.23
97% relevant
This is the same underlying event: ShinyHunters claiming it breached the FBI’s jobs site and stole data tied to agents, employees, and applicants. It appears to add reporting around the scope of the allegedly stolen records and reinforces the attribution to ShinyHunters and the FBI hiring platform.
Lawrence Abrams
2026.09.22
99% relevant
This article appears to be direct coverage of the same claimed incident: ShinyHunters alleging an Oracle PeopleSoft zero-day was used to deface the FBI Jobs site, access FBI systems including AWS GovCloud, and steal employee and applicant data. It adds detail on the claimed scope, including 2TB to 3TB of data, named internal services, and sample records reportedly shown to reporters.
2026.09.22
100% relevant
This article appears to be the first report of the claimed FBI intrusion itself, including the alleged Oracle PeopleSoft zero-day, defacement, lateral movement into AWS GovCloud, and motive tied to prior FBI statements about ShinyHunters.