ShinyHunters Hits the FBI
Can you imagine someone stealing the personal data of FBI agents?
ShinyHunters claims to have done exactly that on September 22.
The group says it obtained names, addresses, Social Security numbers, and even family details of thousands of active and former FBI agents.
Reuters partially verified some of that data, including information that matched records belonging to FBI Director Kash Patel himself, though without confirming the source.
It wasn’t about money — it was purely personal revenge.
ShinyHunters states the attack was not aimed at a financial ransom. Their motivation was to retaliate against a public FBI advisory from May 2026 that described the group’s tactics and warned victims not to pay. The group rejects that characterization and is demanding the FBI withdraw the advisory, using the stolen data as leverage in a direct standoff with U.S. law enforcement.
A zero-day in Oracle PeopleSoft as the entry point.
To explain how they got in, ShinyHunters points to the exploitation of a zero-day in Oracle PeopleSoft, the system linked to the FBI’s recruiting infrastructure. In June 2026, Oracle patched CVE-2026-35273, a critical remote code execution vulnerability in PeopleSoft PeopleTools, and Google and Mandiant linked its active exploitation to ShinyHunters. That track record makes the new claim technically plausible, though it does not prove it.
Between 2 and 3 TB of stolen data, by their own account.
The group claimed to have accessed FBI human resources systems and a platform called Medlink. The website FBIjobs.gov experienced outages coinciding with the announcement. The FBI acknowledged investigating unauthorized activity on that site but did not confirm any breach of its internal systems.
This case is not an isolated exception.
ShinyHunters has been stringing together attacks against all kinds of organizations for months — from universities to major corporations — using techniques that escalate rapidly.
Their command of vulnerabilities in widely deployed enterprise software makes them difficult to contain.
In this case alone, the group offered a sample of 5,000 records as proof and claims to have stolen up to 3 TB.
The FBI is investigating, but has yet to confirm anything.
The stakes are enormous: if the data is real, agents and their families would be exposed to harassment, social engineering, and other forms of abuse. The investigation remains open and the full truth has yet to come to light.
ShinyHunters also openly challenged Clop.
While the FBI case dominates the headlines, ShinyHunters also claimed to have compromised the leak site of the criminal group Clop, one of the most feared actors in the ransomware ecosystem. This move reveals a troubling pattern: the group does not only target companies and public institutions — it takes on other criminal groups as well, reflecting growing aggressiveness and a willingness to operate on multiple fronts.
Agent data in the wrong hands is a weapon.
If the leak is confirmed, the personal information of law enforcement personnel is not just a headline — it is material that can be used to identify undercover agents, pressure their families, or build highly targeted phishing campaigns. The potential damage goes far beyond an exposed database.
Reuters verified at least ten matches in the leaked data.
The agency cross-referenced the records against credit bureau databases and data from previous breaches retained by the firm District 4 Labs. In at least ten cases, the details matched. That does not prove the hack, but it does not rule it out either.
Definitive proof does not yet exist.
There is no public CVE or manufacturer confirmation regarding the alleged new PeopleSoft zero-day used against the FBI. The FBIjobs.gov outage is consistent with an intrusion, but it is not sufficient proof. Until investigators confirm the true scope, ShinyHunters’ account remains a claim.
The FBI investigation is the key piece.
Until that response arrives, the question remains unanswered: how far did they actually get inside FBI systems?
What you can do
- ✓Be wary of unexpected contacts that reference very specific personal details about you.
- ✓Enable two-step verification on all your accounts and services.
- ✓Check whether your data has appeared in breaches using Have I Been Pwned.
What would happen if the data of those who protect us fell into the wrong hands?
Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.
Related articles
NightmareStresser Falls to the FBI
Did you know anyone could rent a massive attack against whoever they wanted?
ShinyHunters Loses Its King
Did you know that a single arrest can bring down an entire criminal network?
Talos opens its secret files
Have you ever wondered what really happens when an attack hits?
Kimsuky lurks on GitHub
Do you know how someone can be spied on without them noticing anything unusual?
eMAPT Conquers Mobile
eMAPT, the INE certification that validates professional penetration testing on Android and iOS mobile applications.
Nacata Security, reach out to us anytime
We are Nacata Security, get to know us
web: nacata.io
email: info@nacata.io
Phone: 919930793
LinkedIn: Nacata Security
Cyberattacks that have already happened and are confirmed: hacked companies, leaked data, services down after an attack, ransoms paid.
Real cases, with names and clear consequences, explained simply so anyone understands what happened and who it affected.
RATING
9.6
Who are we?
At Nacata Security we are an offensive cybersecurity company specialized in audits and penetration testing.
We detect, assess and help mitigate the vulnerabilities of your systems, networks and applications before a real attacker exploits them, offering 360º defense tailored to each client.
We’d be glad to get in touch with you for whatever you need.