Loading story…
The FBI removed a contractor after an internal review linked a breach exposing sensitive personal information about thousands of employees to a missed security patch on a third-party-managed platform. FBI cyber division assistant director Brett Leatherman said the contractor failed to implement an explicitly issued patch. Sources cited by Reuters identified Accenture as the service provider and Oracle PeopleSoft as the affected platform, although the FBI did not publicly name either company. Earlier reporting described exposed employee names from sensitive units, along with medical and psychiatric records.
ShinyHunters claimed it breached the FBI’s job website through a PeopleSoft vulnerability, but Reuters could not confirm that entry route, and the FBI did not identify an exploited CVE. Separately, Mandiant assessed that ShinyHunters was using URL encoding to bypass a web application firewall rule blocking the vulnerable PSEMHUB endpoint associated with CVE-2026-35273; that observation provides context, not confirmation of the FBI breach mechanism. Two ShinyHunters members have been arrested, and the FBI said its continuing investigation could lead to further arrests. The incident underscores the need to verify third-party patch deployment rather than rely solely on contractor assurances or WAF protections.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
FBI Director Kash Patel announced that agents had arrested another suspected ShinyHunters co-conspirator earlier that week as part of the ongoing investigation. The New York Times reported that the suspect was a Canadian national arrested in Pennsylvania; the FBI provided no additional details.
The FBI removed a contractor after its review attributed the breach to failure to install an explicitly issued security patch, and took steps to mitigate further risk. Reuters sources identified Accenture as the service provider, but the FBI did not publicly name the company.
Mandiant reported renewed September attacks against organizations that had deployed web application firewall rules without installing Oracle's update. It assessed that ShinyHunters used URL encoding to bypass filtering of the PSEMHUB endpoint associated with CVE-2026-35273; the FBI did not confirm that vulnerability as its breach mechanism.
ShinyHunters claimed it exploited a PeopleSoft vulnerability to breach the FBI's job website. Reuters could not independently confirm the claimed entry route.
ShinyHunters said it would not publish the stolen FBI employee records but did not confirm deleting them. The statement left unresolved whether the group retained the sensitive information.
ShinyHunters allegedly leaked some stolen FBI employee information to the media. The attack reportedly sought to pressure the FBI into correcting or removing a warning report about the group, which ShinyHunters claimed contained false allegations.
Accenture told Reuters it would continue supporting the FBI's mission. It did not answer questions about the contractor or the alleged patching failure.
Reuters reported that suspected ShinyHunters member Saif al-Din Khader had been detained in Jordan and was cooperating with the FBI and other authorities. The FBI had not publicly confirmed his detention.
Two members of ShinyHunters were arrested. The FBI said its investigation was continuing with partners and could lead to further arrests.
A breach exposed personal details of thousands of FBI employees, including names of staff in sensitive units and medical and psychiatric records. Reuters sources identified the affected system as Oracle PeopleSoft, although the FBI did not publicly name the platform.
Oracle issued a patch in June for the PeopleSoft vulnerability described in Mandiant's findings on renewed ShinyHunters exploitation. The reference does not explicitly establish that this vulnerability was the FBI breach mechanism.
The article reports that ShinyHunters began exploiting PeopleSoft vulnerability CVE-2026-35273 as a zero-day in late May, before Oracle issued a warning and an emergency patch in June. It does not establish that this initial exploitation targeted the FBI.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
20 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcesecuritymagazine.com
Open sourceheise.de
Open sourceitpro.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcelawfaremedia.org
Open sourcereuters.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI arrested another suspected ShinyHunters member amid an international crackdown following a breach associated with FBIjobs.gov. News reports identified the suspect as a Canadian citizen arrested in Pennsylvania, but the bureau did not disclose his identity, charges or alleged role. Unnamed sources linked him directly to the breach; FBI Director Kash Patel's announcement did not establish that connection. The arrest follows the detention of suspected member Saif al-Din Khader in Jordan and the arrest of an alleged group leader in the Netherlands. ShinyHunters claimed it stole sensitive information about FBI personnel and job applicants from a third-party-managed platform. An apparent sample of roughly 5,000 entries supplied to Nextgov/FCW contained employee and family information, including records identifying intelligence and surveillance personnel; Reuters also reported sensitive job details and psychiatric and medical information. The FBI attributed the intrusion to a contractor's failure to apply a security update, while Reuters sources identified the platform as Oracle PeopleSoft and the contractor as Accenture. Reporting indicated that the FBI removed an Accenture contractor in response. Although ShinyHunters said it would not publish the data, potential sale to foreign intelligence services or other buyers remains a concern, underscoring the importance of verifying patch compliance on vendor-managed systems.
Oct 10, 2026
ShinyHunters claims it exploited an alleged pre-authentication Oracle PeopleSoft zero-day for remote code execution against an FBI jobs webpage, defaced the site, and pivoted into FBI-managed AWS GovCloud infrastructure. The group says it exfiltrated roughly **2–3 TB** of data involving current, former, and prospective FBI personnel, as well as agents’ spouses; reported sample records include names, home addresses, and phone numbers, some of which were reportedly verified against public records. The group says the intrusion was not financially motivated and demands that the FBI retract or correct allegations in a May 15 bulletin linking ShinyHunters to harassment, threatening communications, and swatting. The claims, including the alleged PeopleSoft vulnerability, lateral movement, and data theft, remain unverified: the FBI, Oracle, and AWS had not publicly confirmed the incident. If authentic, the exposure could enable targeted harassment, coercion, extortion, or counterintelligence targeting of FBI personnel and their families.
Sep 29, 2026
Google Threat Intelligence and Mandiant reported renewed mass exploitation of **CVE-2026-35273**, a critical CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft Environment Management Hub's `PSEMHUB` servlet. The UNC6240 cluster, linked to ShinyHunters, bypassed literal URL WAF and reverse-proxy rules by encoding the leading `P` in the affected path as `/%50SEMHUB/`; Oracle WebLogic decodes the path before routing it to the vulnerable Java-deserialization endpoint. Dozens of organizations worldwide, including entities in higher education, technology, IT services, healthcare, agriculture, transportation, and government, have been compromised. Attackers deployed JSP web shells, the **SIDEEYE** backdoor, **Neo-reGeorg** tunneling tooling, and **MeshAgent** for persistence and remote access. Oracle released an emergency update for the vulnerability on June 10; defenders should apply it, disable `PSEMHUB` where operationally feasible, review web and application logs and files for compromise, and rotate potentially exposed credentials. Google warned that UNC6240's history of data theft and extortion creates a risk of follow-on extortion and public data leaks. ShinyHunters separately claimed an FBIJobs.gov breach involving another alleged PeopleSoft zero-day and 2–3 TB of data, but no evidence links that claim to CVE-2026-35273.
Oct 2, 2026