Oracle PeopleSoft intrusion behind FBI personnel data exposure
Case score 82
Case score is a discovery signal based on public evidence, not a guaranteed risk rating. Use it to decide what to review first, then verify important details from the linked sources.
- Total
- 82
- Main story score
- 77
- Related evidence lift
- +5 / 20
- Contributing updates
- 1
- Context updates
- 0
- Incident Primary FBI compromise event covering initial access through FBIjobs.gov, movement into AWS GovCloud, and reported data extraction. main
- Data Leak Directly related data-theft and exploitation reporting that ties the FBI exposure to CVE-2026-35273, broader PeopleSoft exploitation, and later FBI response. contributes
Overview
Latest development Open development history FBI hit by network compromise linked to ShinyHunters Attackers first used an **Oracle PeopleSoft** flaw to compromise **FBIjobs.gov**, establishing access through the site managed by a **third-party vendor**. They then moved into **AWS GovCloud** infrastructure, creating the path for the later data extraction.
-
FBI arrests Edward Dubrovsky in ShinyHunters probe
FBI agents arrested Canadian cybersecurity executive Edward Dubrovsky on suspicion of ties to ShinyHunters, and Kash Patel confirmed on X that the bureau had detained another suspected co-conspirator in connection with the FBIjobs.gov incident managed by a third-party vendor.
-
Mandiant confirms ShinyHunters mass-exploited Oracle PeopleSoft CVE-2026-35273
Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters mass-exploited CVE-2026-35273 in Oracle PeopleSoft to steal data from dozens of systems across higher education, technology, healthcare, agriculture, transportation, and government, matching the exploit chain used against the FBI jobs site apply.fbijobs.gov.
-
ShinyHunters claims FBI data theft and shares sample records
ShinyHunters publicly claimed it breached FBI systems with a new Oracle PeopleSoft zero-day, stole between 2TB and 3TB of data, compromised FBI Criminal Justice, HR, Medlink, and other services, and shared sample records plus a defaced FBI Jobs page stating that FBI employee and applicant information had been compromised. The FBI said affected systems were taken offline and the jobs site showed a maintenance message.
-
ShinyHunters says it used Oracle PeopleSoft zero-day access to reach FBI systems
ShinyHunters says it used an unpatched Oracle PeopleSoft zero-day with remote code execution on Monday night to access FBI systems before moving laterally into FBI-managed AWS GovCloud infrastructure.