‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees
Zane A. — Security Consultant
ShinyHunters Claims Breach of FBI Employee Data: 2-3TB Exfiltrated via Oracle Zero-Day
https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/
The Story:
A high-profile hacking group claims it has breached multiple FBI-related services and stolen data on "all FBI employees and applicants." A representative of ShinyHunters told 404 Media the data includes FBI agents' names, home addresses, phone numbers, and information on their spouses.
The data breach could be massively significant and may have national security and counterintelligence implications. Criminals from the same ecosystem as ShinyHunters have previously used hacked data like phone records to track, intimidate, and harass the FBI agents investigating them. The highly sensitive data could also be a boon to foreign intelligence agencies who want to better understand how one of the most important law enforcement and intelligence agencies in the U.S. operates. And if the data fell into the hands of more criminals, FBI agents and their spouses could face serious threats to their safety.
"We hacked the FBI. We hold data on all FBI employees and applicants," the representative told 404 Media.
The claim:
ShinyHunters says it breached the FBI jobs website and multiple FBI-related services.
The sample:
The group provided 404 Media with a sample appearing to contain personal data of 5,000 FBI employees. That data included an alleged address, phone number, date of birth, and in some cases details on their spouse.
Verification:
404 Media put some of the sample phone numbers into open source intelligence tool OSINT Industries and found they did correspond to people with the same name as listed in the sample file. 404 Media also searched some of the records through compromised data tool Darkside, made by cybersecurity company District 4. That revealed some of the phone numbers are associated with U.S. Department of Justice personnel.
The defacement:
ShinyHunters also defaced the FBI jobs website on Tuesday. The defacement says, "this site has been seized by ShinyHunters," an obvious nod to the seizure notices the FBI and other law enforcement agencies often put on sites after taking them down. At the time of writing, the FBI jobs website says, "Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable."
The defacement adds: "All FBI data was compromised including PII/PHI [personally identifiable information and protected health information] on incumbent and former FBI employees and all applicant information. We have a lot more than we claim here."
The announcement ended with another jab at the administration, this time mocking President Trump's Truth Social post style: "Thank you for your attention to this matter."
The FBI's response: After publication of this article, an FBI spokesperson told 404 Media in an email: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."
How They Say They Did It:
The ShinyHunters representative told 404 Media the group used a zero-day exploit in an Oracle product called PeopleSoft. From there, the group managed to access AWS GovCloud servers and downloaded data.
The representative said the exfiltrated data amounted up to between two and three terabytes.
What ShinyHunters Wants:
Typically, ShinyHunters hacks targets and then attempts to extort them. The group threatens to publicly release more compromised data if the victim organization or company doesn't pay a hefty fee. Obviously, it is unlikely that the FBI would ever pay a ransom like this.
When asked if ShinyHunters was going to attempt to extort the FBI, the representative said: "what we plan to do is not something I'd call extortion, maybe coercion."
"This is not financially motivated," they added.
In a post on its leak website, ShinyHunters said the FBI made "false allegations" in a previously published report. Previously, the FBI said that ShinyHunters exaggerates its claims of access to sensitive data to illicit payment, that the group sends threatening text messages and phone calls to victims and their families, and sometimes performs swattings. In the post, ShinyHunters said it's "allowing you "the FBI" a time of 1 week to correct" or remove the report.
Why This Matters:
For Red Teams: This demonstrates the value of chaining exploits; an Oracle PeopleSoft zero-day leading to AWS GovCloud access. It also highlights the reconnaissance value of job portals and applicant systems, which often have weaker security postures than primary operational infrastructure.
For Blue Teams: The breach underscores the risks of third-party and legacy enterprise software (Oracle PeopleSoft) in government environments. Organizations should audit HR and applicant tracking systems for unpatched vulnerabilities and enforce strict segmentation between applicant-facing systems and core operational networks.
For Developers: Applicant tracking systems and HR platforms are frequently overlooked in security reviews. If your organization runs PeopleSoft or similar enterprise HR software, it deserves the same threat modeling as your customer-facing services.
Feel free to Join my platform – always open to discussion😊
ISCSECURITY Master Class Series: https://iscsecurity.org
Join the discussion: https://cyberr.ai/groups/iscsecurity
Instagram: https://www.instagram.com/iscsecurity73/
GitHub: https://github.com/zanderson73/
#cybersecurity #FBI #ShinyHunters #databreach #Oracle #PeopleSoft #redteam #blueteam #infosec #zeroDay #AWSSGovCloud
3 reactions · 1 comments
Topics: #blueteam, #peoplesoft, #databreach, #shinyhunters, #infosec, #fbi, #oracle, #redteam, #zeroday, #cybersecurity
Comments
Schomer: The reported breach of the FBIjobs portal by ShinyHunters highlights a massive systemic issue: the vulnerability of public sector supply chains due to implicitly trusted third-party service abstractions. When a specialized portal or job board is compromised, threat actors don't just steal localized database blocks; they look to exploit the unmonitored communication pathways connecting those extern