Hackers took FBI personnel data through the same HR software enterprises run

ShinyHunters claimed on September 22nd, 2026, that it had broken into FBIJobs.gov, the bureau’s recruiting portal. The group put its haul at 2 to 3 terabytes of personnel data, a figure the FBI has not confirmed. The Justice Department told lawmakers that the FBI designated the matter a cybersecurity incident the same day.

FBI documents show the bureau’s recruiting arm runs on Oracle PeopleSoft and AWS GovCloud. Universities, healthcare organizations, and government agencies run HR, payroll, and student records on PeopleSoft. Mandiant’s September 25th report found attacker web shells in all three sectors. The FBI’s problem is a common enterprise architecture with an unusually sensitive workforce behind it.

Security leaders should protect recruiting and HR platforms with the same controls they put around identity systems.

The FBIJobs.gov Breach Reached Agents’ Personnel and Medical Records

Hiring systems combine identity, career history, family details, and health records in one internet facing place.

In an internal notification, the FBI told employees that their names, addresses, job titles, and Social Security numbers were exposed. Samples the group circulated also included blood and urine test records and psychiatric reports.

The group gave news outlets a sample of about 5,000 FBI personnel records. Those records reportedly named members of the FBI’s Remote Operations Unit, a secretive team involved in hacking operations. Spot checks against credit bureau records and older breach data matched details in at least 10 of them, including FBI Director Kash Patel’s. The Justice Department told lawmakers that investigators had not yet determined how many people were affected.

Jon DiMaggio, principal researcher at Arkem Cyber, warned that assignment details could help hostile actors find people working on issues they care about. He said the exposure could reach the sources and investigations tied to that work.

Adversaries have used FBI data this way before. A Justice Department inspector general report found that a Mexican drug cartel hired a hacker around 2018 to track a senior FBI official in Mexico City. The cartel used that surveillance to kill potential FBI informants.

Workforce records are a wider target. The Defense Manpower Data Center said in a breach notice that intruders exploited a flaw in a file sharing system between October 2025 and mid July 2026. Pentagon spokesperson Susan Gough confirmed that the breach affects about 2.8 million living people. No group has been tied to it.

Corporate HR platforms hold similar records: background checks, benefits elections, direct deposit details, and emergency contacts. An attacker with that data can impersonate an employee to the help desk or target an executive’s family.

The Operator’s Lens

• Reclassify your recruiting portal and HR platform as crown jewel systems, with the same patch deadlines, logging, and access reviews as your identity provider.
• Map what the applicant portal can reach, and cut any path to payroll, background check, or medical records that the hiring workflow does not need.

The FBI has not said how the attackers got in, but ShinyHunters has been breaking into PeopleSoft servers since May. Its latest technique slips past the firewall rules many customers used in place of a patch.

ShinyHunters Beat PeopleSoft Firewall Rules With One Encoded Character

A single character reopened a flaw that many PeopleSoft customers believed they had contained.

Oracle issued an out-of-band Security Alert on June 10th, 2026, for CVE-2026-35273 in PeopleSoft PeopleTools 8.61 and 8.62. The flaw allows remote code execution without a login. Oracle rated it 9.8 on the Common Vulnerability Scoring System.

ShinyHunters had already exploited it as a zero-day against universities from May 27th to June 9th, according to Mandiant. Where patching could not happen quickly, Mandiant’s June guidance recommended blocking the vulnerable /PSEMHUB/ path at the web application firewall (WAF).

On September 25th, Mandiant and Google Threat Intelligence Group reported that the group had found a way around those rules. The attackers requested /%50SEMHUB/ instead of /PSEMHUB/. The code %50 is simply the letter P, URL encoded.

Many WAF and proxy rules compare the raw path before decoding it. The PeopleSoft server decodes the request and passes it to the vulnerable code anyway.

The renewed wave put web shells on dozens of systems in higher education, healthcare, technology, transportation, and government, Mandiant found. Targets typically received five to 15 probe requests before exploitation. A quarter of the attackers’ commands ran as root or SYSTEM, which gave them full control of the host.

ShinyHunters has claimed it used a new PeopleSoft flaw against the FBI rather than this bypass. The FBI says it is still investigating whether the attackers came in through third-party software or its own systems.

Either way, a firewall rule is not a patch. “WAF rules and path-based blocking are not a substitute for patching,” Mandiant wrote in its September guidance.

The Operator’s Lens

• Give every WAF rule written as a stand-in for a patch an expiry date, and escalate any rule that outlives it to the CISO.
• Require gateways to decode and normalize request paths before matching, and test each emergency rule against encoded and mixed case variants.
• If you run PeopleSoft, apply the June 10th patch, disable the PSEMHUB service, and search WebLogic logs for /PSEMHUB/ and /%50SEMHUB/ requests.

Patching closes the door. It does nothing about data that has already left, or about an attacker who wants something other than money.

Extortion Without a Ransom Demand

ShinyHunters asked the FBI for a retraction, not a payment.

The group said its attack was not about money. It demanded that the FBI retract its May 15th advisory about the group by September 29th.

That advisory warned that ShinyHunters pressures victims with threatening calls and texts to them and their families, and in some cases with swatting. It also warned that the group uses real or exaggerated claims of access to push victims to pay.

The deadline passed with the advisory still online. ShinyHunters’ leak site went offline on September 30th, and the group said it had no intention of publishing the data. The FBI’s advisory notes that the group has posted stolen data to its leak site before.

A group representative later said the site went down for upgrades after rival hackers hit it with a denial-of-service attack. The representative said the outage had nothing to do with the FBI case.

Cynthia Kaiser is a former deputy director of the FBI’s Cyber Division who now leads ransomware research at Halcyon. She called the attack reckless, given the bureau’s policy of never paying or negotiating with criminals.

Brett Leatherman, assistant director of the FBI’s Cyber Division, answered in a video on September 29th. He said the group’s alleged leader and co-conspirators had breached more than 140 organizations since 2025. He said they had taken at least $70 million in extortion payments.

Dutch police arrested a 24-year-old Amsterdam man on September 15th on suspicion of ShinyHunters membership. He was already in custody days before the FBI hack was announced, and the group says he has no connection to it. “You know how to find us, and we know how to find you,” Leatherman said.

Most ransomware playbooks turn on one decision, whether to pay. A demand for a retraction, a policy change, or silence skips that decision and puts pressure directly on people.

The Operator’s Lens

• When HR data is stolen, lock down help desk resets for exposed staff and brief local police on the swatting risk to their homes.

Pressure on people works best when those people are confused. Inside the FBI, confusion came first.

Staff Should Hear About a Breach From You First

Many FBI employees learned about the breach from the news.

Current and former FBI employees, speaking anonymously, said many colleagues first learned of the breach from news coverage. An FBI spokesperson said the bureau sent multiple bureau-wide communications within 24 hours of public reporting.

One former agent in touch with colleagues described management as lost and said agents were getting no clear advice.

In a September 26th email, the bureau told its workforce it was assuming the hackers held data on every FBI employee. The bureau also told employees it was evaluating additional identity protection and support services for them and their families.

Michael McPherson is a former FBI agent and now senior vice president of security operations at ReliaQuest. He warned that exposed home addresses reach family members who are normally insulated from the threats of the job.

Employees who learn about a breach from the press discount the next internal message. That gap is where phishing emails dressed as breach updates land.

A first notice does not need the forensic answer. It needs what is known, what is not, what staff should do now, and when the next update will arrive.

The Operator’s Lens

• Commit to a fixed update schedule for affected staff, and keep it even when the forensic scope is still unknown.

The FBI’s breach hit the kind of system most organizations treat as administrative plumbing. Recruiting and HR platforms face the internet, hold data that stays valuable for decades, and run software with an active exploit campaign against it.

Organizations that defend those platforms like identity systems will be better placed to contain an intrusion and to keep their employees’ trust.