The ShinyHunters gang claims it broke into FBI systems through an unpatched Oracle PeopleSoft flaw and stole employee and applicant records.
The Untouchables have confirmed they might have been touched and are investigating reports of unauthorised activity affecting FBIjobs.gov. It has not confirmed a breach, the existence of the alleged PeopleSoft zero-day or the theft of any data. ShinyHunters has considerably fewer doubts.
The group told BleepingComputer it used a remote code execution flaw on Monday night, then moved into FBI-managed AWS GovCloud systems. It claims to have taken between 2TB and 3TB of data, including records on current and former staff and job applicants. It says it also reached criminal justice, human resources, and medical services.
BleepingComputer received a screenshot showing the FBI Jobs application site defaced with the gang’s Umbreon Pokémon logo and a message claiming it had stolen employee and applicant data. ShinyHunters supplied the image, so it cannot establish how far the attackers got beyond the website.
The gang provided two purported sample records. BleepingComputer could not independently verify their authenticity or source. Separately, 404 Media received a sample of about 5,000 alleged FBI employee records and reported confirming that some phone numbers matched the named people or US Department of Justice personnel. That checks some details in the sample; it does not settle the gang’s much larger claims.
ShinyHunters says it is using the same alleged PeopleSoft flaw against other organisations, including Fortune 500 companies. Oracle had not confirmed the vulnerability when BleepingComputer reported the story. Administrators would probably prefer confirmation before discovering what a zero-day does to their week.
The gang says the attack was retaliation for an FBI report about ShinyHunters published in May. It has demanded that the agency correct or remove the report within a week, while insisting the demand is not extortion. When asked whether it would release the allegedly stolen data if the FBI refused, the group declined to say.
