Loading story…
The FBI removed a contractor after an internal review linked a breach exposing sensitive personal information about thousands of employees to a missed security patch on a third-party-managed platform. FBI cyber division assistant director Brett Leatherman said the contractor failed to implement an explicitly issued patch. Sources cited by Reuters identified Accenture as the service provider and Oracle PeopleSoft as the affected platform, although the FBI did not publicly name either company. Earlier reporting described exposed employee names from sensitive units, along with medical and psychiatric records.
ShinyHunters claimed it breached the FBI’s job website through a PeopleSoft vulnerability, but Reuters could not confirm that entry route, and the FBI did not identify an exploited CVE. Separately, Mandiant assessed that ShinyHunters was using URL encoding to bypass a web application firewall rule blocking the vulnerable PSEMHUB endpoint associated with CVE-2026-35273; that observation provides context, not confirmation of the FBI breach mechanism. Two ShinyHunters members have been arrested, and the FBI said its continuing investigation could lead to further arrests. The incident underscores the need to verify third-party patch deployment rather than rely solely on contractor assurances or WAF protections.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
The FBI removed a contractor after its review attributed the breach to failure to install an explicitly issued security patch, and took steps to mitigate further risk. Reuters sources identified Accenture as the service provider, but the FBI did not publicly name the company.
Mandiant reported renewed September attacks against organizations that had deployed web application firewall rules without installing Oracle's update. It assessed that ShinyHunters used URL encoding to bypass filtering of the PSEMHUB endpoint associated with CVE-2026-35273; the FBI did not confirm that vulnerability as its breach mechanism.
ShinyHunters claimed it exploited a PeopleSoft vulnerability to breach the FBI's job website. Reuters could not independently confirm the claimed entry route.
ShinyHunters said it would not publish the stolen FBI employee records but did not confirm deleting them. The statement left unresolved whether the group retained the sensitive information.
ShinyHunters allegedly leaked some stolen FBI employee information to the media. The attack reportedly sought to pressure the FBI into correcting or removing a warning report about the group, which ShinyHunters claimed contained false allegations.
Accenture told Reuters it would continue supporting the FBI's mission. It did not answer questions about the contractor or the alleged patching failure.
Reuters reported that suspected ShinyHunters member Saif al-Din Khader had been detained in Jordan and was cooperating with the FBI and other authorities. The FBI had not publicly confirmed his detention.
Two members of ShinyHunters were arrested. The FBI said its investigation was continuing with partners and could lead to further arrests.
A breach exposed personal details of thousands of FBI employees, including names of staff in sensitive units and medical and psychiatric records. Reuters sources identified the affected system as Oracle PeopleSoft, although the FBI did not publicly name the platform.
Oracle issued a patch in June for the PeopleSoft vulnerability described in Mandiant's findings on renewed ShinyHunters exploitation. The reference does not explicitly establish that this vulnerability was the FBI breach mechanism.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
12 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourcehackread.com
Open sourcemalware.news
Open sourcemalware.news
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcereuters.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters claims it exploited an alleged pre-authentication Oracle PeopleSoft zero-day for remote code execution against an FBI jobs webpage, defaced the site, and pivoted into FBI-managed AWS GovCloud infrastructure. The group says it exfiltrated roughly **2–3 TB** of data involving current, former, and prospective FBI personnel, as well as agents’ spouses; reported sample records include names, home addresses, and phone numbers, some of which were reportedly verified against public records. The group says the intrusion was not financially motivated and demands that the FBI retract or correct allegations in a May 15 bulletin linking ShinyHunters to harassment, threatening communications, and swatting. The claims, including the alleged PeopleSoft vulnerability, lateral movement, and data theft, remain unverified: the FBI, Oracle, and AWS had not publicly confirmed the incident. If authentic, the exposure could enable targeted harassment, coercion, extortion, or counterintelligence targeting of FBI personnel and their families.
Sep 29, 2026
Google Threat Intelligence and Mandiant reported renewed mass exploitation of **CVE-2026-35273**, a critical CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft Environment Management Hub's `PSEMHUB` servlet. The UNC6240 cluster, linked to ShinyHunters, bypassed literal URL WAF and reverse-proxy rules by encoding the leading `P` in the affected path as `/%50SEMHUB/`; Oracle WebLogic decodes the path before routing it to the vulnerable Java-deserialization endpoint. Dozens of organizations worldwide, including entities in higher education, technology, IT services, healthcare, agriculture, transportation, and government, have been compromised. Attackers deployed JSP web shells, the **SIDEEYE** backdoor, **Neo-reGeorg** tunneling tooling, and **MeshAgent** for persistence and remote access. Oracle released an emergency update for the vulnerability on June 10; defenders should apply it, disable `PSEMHUB` where operationally feasible, review web and application logs and files for compromise, and rotate potentially exposed credentials. Google warned that UNC6240's history of data theft and extortion creates a risk of follow-on extortion and public data leaks. ShinyHunters separately claimed an FBIJobs.gov breach involving another alleged PeopleSoft zero-day and 2–3 TB of data, but no evidence links that claim to CVE-2026-35273.
Oct 2, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026