Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

FBI employee and applicant data leak claim

Data Leak
First reported
Last updated
Happening score
H score 95
5 unique sources, 8 articles

Summary

Hide ▲

ShinyHunters publicly claimed it breached FBI jobs systems through an Oracle PeopleSoft flaw, stole 2TB to 3TB of data, and exposed information tied to FBI employees and job applicants from services including Criminal Justice (CJ), HR, and Medlink. The FBI said it is investigating the unauthorized-activity claims affecting FBIjobs.gov, and the access and leak claims remain unverified in the supplied context. Later reporting said Mandiant and the Google Threat Intelligence Group (GTIG) confirmed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft across dozens of systems in higher education, technology, healthcare, agriculture, transportation, and government. The same exploit thread was linked to a URL-encoding bypass against WAF rules and to renewed abuse of unpatched PeopleSoft servers.

Related Happenings

Jordan detains Rey in ShinyHunters investigation

Law Enforcement
H score53 First: 03.10.2026 22:09 Last: 03.10.2026 22:09 Sources 1

About this happening: Jordanian authorities reportedly detained Rey — identified as Saif al-Din Khader — in Jordan on September 29, 2026, and he is said to be cooperating with the...

Open Happening

Defense Manpower Data Center (DMDC) hit by network compromise

Incident
H score18 First: 01.10.2026 12:44 Last: 01.10.2026 12:44 Sources 1

About this happening: The Defense Manpower Data Center (DMDC) disclosed a breach of the Pentagon human resources management system that exposed sensitive personnel data for more than 3 millio...

Open Happening

Dutch police arrest tied to ShinyHunters hacking investigation

Law Enforcement
H score59 First: 28.09.2026 22:49 Last: 28.09.2026 22:49 Sources 1

How related: "It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters," the Politie Landelijke Opsporing en Interventies said in an X post Monday.

About this happening: Dutch police and the FBI are moving against ShinyHunters after the arrest of a 24-year-old Amsterdam man alleged to be one of the group's leaders. The suspect was...

Open Happening

Anthropic Claude misuse analysis of multi-agent reconnaissance, exploitation, and exfiltration

Technical Analysis
H score59 First: 11.09.2026 17:29 Last: 11.09.2026 17:29 Sources 1

About this happening: Anthropic says Claude AI was abused by multiple threat groups, including ShinyHunters, Midnight Blizzard, and GTG-10007, for credential harvesting, recon...

Open Happening

FLHSMV DAVID driver records leak-extortion

Data Leak
H score41 First: 08.09.2026 19:35 Last: 08.09.2026 19:35 Sources 1

About this happening: A claimed FLHSMV DAVID data leak has put records for more than 200,000 Florida drivers at risk of public release and extortion. The threat group says it used a password-...

Latest development: 11.09.2026 22:00

FLHSMV learned of a data breach affecting its DAVID driver database on September 4, 2026, said the breach was quickly mitigated and no further breach was ongoing, and said its investigation tied the intrusion to compromised credentials belonging to a single Plant City Police Department user stored on a personal device.

Open Happening

Timeline

  1. 06.10.2026 09:56 1 articles · 12h ago

    FBI removes Accenture contractor after Oracle PeopleSoft patch failure

    Mitigation Patch Update

    The FBI said its review determined that the FBI employee-data theft stemmed from a security failure on a third-party Oracle PeopleSoft platform after a contractor failed to implement a security patch, and the bureau removed the contractor while taking steps to mitigate further risk and protect its workforce.

    Show sources
    Open in new tab
  2. 29.09.2026 14:01 1 articles · 7d ago

    Dutch police arrest 24-year-old Amsterdam man in ShinyHunters investigation tied to FBI jobs site defacement

    Legal Policy Action Update

    Dutch police arrested a 24-year-old Amsterdam man on September 16 in an investigation into ShinyHunters. The suspect is believed to be Pepijn van der Stap, and the case is tied to the group’s FBI jobs site defacement that used a modified exploit for CVE-2026-35273.

    Show sources
    Open in new tab
  3. 28.09.2026 18:08 2 articles · 8d ago

    Mandiant confirms ShinyHunters mass-exploited Oracle PeopleSoft CVE-2026-35273

    Technical Analysis Update

    Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters mass-exploited CVE-2026-35273 in Oracle PeopleSoft to steal data from dozens of systems across higher education, technology, healthcare, agriculture, transportation, and government, matching the exploit chain used against the FBI jobs site apply.fbijobs.gov.

    Show sources
    Open in new tab
  4. 22.09.2026 22:13 1 articles · 13d ago

    ShinyHunters says it used Oracle PeopleSoft zero-day access to reach FBI systems

    Exploitation Observed

    ShinyHunters says it used an unpatched Oracle PeopleSoft zero-day with remote code execution on Monday night to access FBI systems before moving laterally into FBI-managed AWS GovCloud infrastructure.

    Show sources
    Open in new tab
  5. 22.09.2026 22:13 5 articles · 13d ago

    ShinyHunters claims FBI data theft and shares sample records

    Initial Disclosure

    ShinyHunters publicly claimed it breached FBI systems with a new Oracle PeopleSoft zero-day, stole between 2TB and 3TB of data, compromised FBI Criminal Justice, HR, Medlink, and other services, and shared sample records plus a defaced FBI Jobs page stating that FBI employee and applicant information had been compromised. The FBI said affected systems were taken offline and the jobs site showed a maintenance message.

    Show sources
    Open in new tab