The ShinyHunters FBI Breach Claim: What Is Confirmed, What Is Not, and What Defenders Should Do

The FBI has confirmed one thing about the breach that ShinyHunters says it carried out this week: it is investigating. "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating," the bureau told BleepingComputer and TechCrunch on 22 September 2026.¹² Almost everything else in circulation, including how much data was taken, which systems were reached and how the attackers got in, comes from ShinyHunters itself. A smaller part has been partly verified by journalists.

That distinction matters, because the extortion group has a record of exaggerating what it holds. The FBI said as much in a warning about the group published in May.³ It matters just as much for defenders. The route ShinyHunters says it used, a previously unknown flaw in Oracle PeopleSoft, would be the second PeopleSoft zero-day attributed to the group this year.

This article reflects reporting available on 24 September 2026. It will be updated as the FBI, Oracle or independent researchers publish more.

Free to reuse under CC BY 4.0 with a link to this article. Download

What is confirmed, and what is only claimed

BleepingComputer says it has not independently verified the alleged zero-day, the lateral movement or the amount of data stolen.¹ Nor have we.

The motive the group gives

ShinyHunters says the attack was a response to the FBI's public service announcement of 15 May 2026, alert number I-051526-PSA. That announcement warned about the group after an attack that disrupted an online learning management system used by schools and universities across the United States.³ The PSA describes ShinyHunters as a group "specializing in large-scale data breaches and extortion". It says that its actors use "real or exaggerated claims of access" to pressure victims, harass victims and their families by phone and text, in some cases carry out swatting, and sometimes falsely claim to hold compromising material that does not exist.³

The group disputes those characterisations. It told The Hacker News that the attack was not financially motivated and was meant to "set the record straight".⁴ When BleepingComputer asked whether the data would be released if the FBI did not change its report, the group replied "No comment".¹

The alleged route in: PeopleSoft, again

ShinyHunters told BleepingComputer that it found "another" PeopleSoft zero-day the day before the attack and "immediately exploited it on the FBI".¹ The Hacker News reported that there were no public details of a pre-authenticated remote code execution flaw in PeopleSoft at the time of writing.⁴ BleepingComputer said it had contacted Oracle and Google's Mandiant about the claim.¹

What is documented is the group's earlier PeopleSoft campaign:

• The flaw. On 10 June 2026, Oracle published a Security Alert for CVE-2026-35273 in PeopleSoft Enterprise PeopleTools, affecting versions 8.61 and 8.62. It is in the Updates Environment Management component, can be exploited remotely over HTTP without authentication, and can lead to remote code execution. Oracle scored it 9.8 under CVSS 3.1, and says earlier, unsupported versions are likely affected too.⁵
• The campaign. Mandiant and Google Threat Intelligence Group attributed exploitation of the flaw to UNC6240 (ShinyHunters) and observed it between 27 May and 9 June 2026. That is before Oracle's advisory, so the flaw was exploited as a zero-day.⁶
• The targets. Mandiant notified more than 100 organisations whose IP addresses correlated with potentially vulnerable endpoints. Most were in the United States, and 68% were in higher education.⁶
• What the attackers did once inside. Mandiant describes remote-management agents disguised as Microsoft Azure binaries, reconnaissance of PeopleSoft configuration files, and a propagation script. The script sprayed SSH logins against internal hosts using a hard-coded list of common usernames and passwords.⁶

What PeopleSoft operators should do now

The steps below come from Oracle's and Mandiant's published guidance for CVE-2026-35273.⁵⁶ They are the best available guide to the known flaw. If ShinyHunters has a new one, no patch exists yet, so reducing exposure is the only lever.

Reduce exposure

• Confirm which PeopleTools version you run and apply Oracle's mitigations for CVE-2026-35273 through the patch availability document in the advisory.⁵
• Disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application in single-server configurations.⁶
• If you cannot, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the network perimeter. Mandiant warns that relying on WAF body-inspection rules alone is insufficient, because they can be bypassed. It also notes that restricting these endpoints does not break normal user sessions.⁶

Look for signs you have already been compromised

• WebLogic access logs showing POST requests to /PSEMHUB/hub or /PSIGW/HttpListeningConnector from external addresses.⁶
• Unexpected .jsp files under the PSEMHUB.war application directory, and unexpected logs, persistantstorage or scratchpad directories under the PSEMHUB paths.⁶
• Recently created or modified .xml files under envmetadata/data/environment, which can be used for persistence that runs on restart.⁶
• Outbound SMB traffic (TCP 445) from PeopleSoft hosts to external destinations.⁶

Limit what happens after a foothold

What it means outside the United States

The FBI incident is American, but the exposure is not. Two points apply directly to organisations in Norway and elsewhere in Europe:

• Breach notification. If an incident involves personal data, the GDPR requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.⁷ In Norway that authority is Datatilsynet, which publishes guidance on handling personal data breaches.⁸ HR and applicant data, the kind at stake here, is squarely personal data.
• Extortion playbooks. The FBI's May announcement describes pressure applied to individuals as well as organisations, including messages and calls to victims and their family members.³ Incident response plans for data-theft extortion should cover how to warn and support affected staff, not just how to restore systems. The FBI's own advice to individuals contacted by the group is to verify contacts through known channels and not to pay or respond to demands.³

What to watch

• Confirmation from the FBI of what, if anything, was accessed, and whether a third-party provider was the point of entry.
• A statement or advisory from Oracle on whether a second PeopleSoft flaw exists.
• What ShinyHunters does when its one-week deadline passes, and whether any data it publishes matches what it claims.
• Further PeopleSoft victims. ShinyHunters says it is using the same alleged flaw against other organisations, including large companies.¹

Frequently asked questions

Has the FBI confirmed that ShinyHunters breached its systems?

Not as of 24 September 2026. The FBI has said it is aware of claims of unauthorised activity affecting FBIjobs.gov and is investigating. In a post on X it said the point of breach, whether a third party or the FBI's own enterprise, was still undetermined.

Which PeopleSoft vulnerability was used?

ShinyHunters claims it used a new, unpatched PeopleSoft zero-day. No details of such a flaw had been published at the time of writing. A separate PeopleSoft flaw, CVE-2026-35273, was exploited by the same group as a zero-day in May and June 2026, and Oracle has published an advisory for it.

What should organisations running PeopleSoft do now?

Apply Oracle's guidance for CVE-2026-35273, disable or remove the Environment Management Hub where possible, block external access to the /PSEMHUB/ and /PSIGW/HttpListeningConnector paths, and check logs and the web tier for the compromise indicators Mandiant has published.

Sources

1. Lawrence Abrams, "ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach", BleepingComputer, 22 September 2026 (updated with the FBI's statement). https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³

2. Zack Whittaker, "Hacking group ShinyHunters claims it breached the FBI, stole agents' and applicants' data", TechCrunch, 22 September 2026. https://techcrunch.com/2026/09/22/hacking-group-shinyhunters-claims-it-breached-the-fbi-stole-agents-and-applicants-data/ ↩ ↩² ↩³ ↩⁴ ↩⁵

3. FBI Internet Crime Complaint Center, "ShinyHunters: Cyber Criminal Group Attacks Learning Management System", Alert I-051526-PSA, 15 May 2026. https://www.ic3.gov/PSA/2026/PSA260515 ↩ ↩² ↩³ ↩⁴ ↩⁵

4. Ravie Lakshmanan, "ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants", The Hacker News, 23 September 2026. https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html ↩ ↩² ↩³ ↩⁴ ↩⁵

5. Oracle, "Oracle Security Alert Advisory - CVE-2026-35273", Rev 1, 10 June 2026. https://www.oracle.com/security-alerts/alert-cve-2026-35273.html ↩ ↩² ↩³

6. Mandiant, "ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit", Google Cloud blog, 11 June 2026. https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

7. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 33. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩

8. Datatilsynet, "Brudd på personopplysningssikkerheten (avvik)". https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/avvik/ ↩