Threat intel

On September 22, 2026, the extortion group ShinyHunters posted a claim that it had broken into Federal Bureau of Investigation systems and stolen personal data on current and former agents, plus anyone who ever applied for an FBI job. The group says the haul spans two to three terabytes pulled from CJIS (Criminal Justice Information Services, the FBI system that holds fingerprints and criminal history records), HR systems, and a personnel platform called Medlink. As part of the pressure campaign, the attackers briefly defaced the FBIjobs.gov recruitment site with a message reading that the site had been "seized by ShinyHunters."

The FBI has not confirmed any of it. In a statement quoted by Reuters and other outlets, the Bureau said it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." That leaves the scope and even the authenticity of the claimed data unverified. What is not in question is that ShinyHunters has a real track record: the group is behind the 2024 Snowflake customer-data campaign, the 2025 Salesforce and Salesloft Drift token thefts, and the Canvas learning-platform breach at Instructure earlier this year. Whether or not the FBI claim holds up in full, the entry point it describes, a widely deployed HR platform, is worth checking regardless.

How it works

ShinyHunters says it got in through Oracle PeopleSoft, an enterprise resource planning platform that large government agencies and companies run for HR, payroll, and benefits administration. The group has not published a technical writeup or a CVE, so the exact flaw is unconfirmed. One screenshot the group shared shows a page under a /PSEMHUB/ path on the FBI's jobs site returning Linux system details, which is consistent with an internal PeopleSoft integration or monitoring endpoint that should sit behind a firewall being reachable from the open internet instead.

That pattern, an admin or integration interface exposed where it should not be, is the common thread in how PeopleSoft and similar ERP platforms get compromised in extortion campaigns generally: an Integration Broker or PeopleSoft Internet Architecture (PIA) servlet left internet-facing, single sign-on configured so a service account trusts requests it should reject, or a PeopleSoft instance running behind on Oracle's quarterly Critical Patch Update. None of these require zero-day sophistication; each is a configuration or maintenance gap that a routine external scan would catch.

HR platforms are attractive precisely because they sit at the intersection of identity data and organizational trust. A single PeopleSoft instance can hold Social Security numbers, bank details for payroll, benefits enrollment, and background-check records, all under credentials that IT security teams often audit less closely than the core network because the system is seen as "just HR." At the FBI specifically, that same category of data extends to background-investigation material and, per the claim, CJIS-adjacent records, which is what makes this an unusually high-leverage target even before any of it is confirmed.

What attackers are doing

ShinyHunters frames the FBI breach as retaliation. On May 15, 2026, the FBI's Internet Crime Complaint Center published PSA260515, a public service announcement describing ShinyHunters' targeting of Canvas, the Instructure-owned learning management system used by thousands of schools and universities, and urging victims not to pay. ShinyHunters says that PSA exaggerated its methods, and it is demanding the FBI retract or correct it within a week or see the stolen data published.

The Canvas breach that PSA covered was itself large: ShinyHunters claimed roughly 3.65 terabytes taken from Instructure, affecting institutions including Harvard, Oxford, and MIT. It followed the group's pattern from the prior two years: bulk credential theft against Snowflake customer environments in 2024, then abuse of stolen Salesloft Drift OAuth tokens against Salesforce customers in 2025, a campaign researchers tie to roughly 1.5 billion records across some 760 organizations. In each case the group's leverage came from breaching one platform that many other organizations depend on, then extorting the platform's customers directly.

The claimed FBI intrusion follows the same extortion playbook rather than a quiet espionage operation: initial access on September 21, a public claim and evidence screenshots the next day, a defacement of FBIjobs.gov timed for maximum visibility, and a demand with a deadline. The defacement itself did no lasting technical damage; its purpose was to prove access publicly and force a response within the deadline. None of that confirms the underlying data theft, though it matches how ShinyHunters ran its Canvas and Salesforce campaigns before those claims were later verified.

What to do

Any organization running PeopleSoft, or a comparably large HR or ERP platform, should treat this claim as a prompt to check now rather than wait for the FBI's investigation to conclude.

• Find and lock down exposed admin and integration endpoints. Search your external attack surface for PeopleSoft Integration Broker, PIA servlet, and PSEMHUB-style paths reachable from the internet, and move anything that does not need to be public behind your VPN or internal network.
• Rotate and check default PeopleSoft accounts. The platform ships with well-known default account names such as PS, VP1, and PTDMO. Confirm none still use default or weak passwords, and rotate credentials on any service account with broad database access.
• Put MFA on every HR system account, including service accounts. A stolen service-account credential with no second factor is the fastest route from the internet to the HR database; vault the credential and require MFA or certificate-based auth for interactive admin access.
• Segment HR and CJIS-adjacent systems from the general corporate network. A compromised HR account should not be able to reach unrelated production systems, and vice versa; enforce that with firewall rules and network segmentation, since application-level permissions alone will not stop lateral movement.
• Check Oracle's Critical Patch Update history for your PeopleTools and PeopleSoft versions. Oracle publishes these quarterly; confirm your instance is current and that any published PeopleSoft advisories have been applied, since unpatched ERP platforms are the most common way this class of attack succeeds.
• Look for the signs of this kind of intrusion now. Review PS Query and nVision reporting-tool logs for unusual bulk exports, check for new admin or superuser accounts that do not map to an HR onboarding record, and look for authentication spikes against HR or recruitment portals from IP ranges you do not normally see.

Even before the FBI confirms anything, the pattern ShinyHunters describes, an internet-facing gap in an HR platform that leads to data an attacker can hold for leverage, is one you can check for in your own PeopleSoft or ERP environment this week.

Our attack surface management work finds exactly this kind of exposed admin interface before an attacker does, and our security operations team can help you check HR and identity systems for the access patterns described above. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the check.

---

Sources: The Record, TechCrunch, The Hacker News, CyberScoop, FBI IC3 PSA260515.