2026 FBI — ShinyHunters FBIJobs/PeopleSoft; staff told SSNs/PII stolen (cybersecurity incident)

Unverified leak-site / extortion claim — ShinyHunters claimed September 21–22, 2026 that it exploited a new Oracle PeopleSoft zero-day for RCE on an FBI server, moved laterally into AWS GovCloud, and stole 2–3 TB including employee/applicant PII/PHI (Criminal Justice, HR, Medlink alleged). Group defaced apply.fbijobs.gov (screenshot to press); site later showed maintenance / portals unavailable. 404 Media reviewed ~5,000-record sample and matched some phone numbers to public records; Reuters partially matched ≥9 sample rows to credit-bureau/prior-breach data but could not prove FBI-system provenance. FBI had not confirmed at indexing; BleepingComputer/TechCrunch note no independent verification of the zero-day or volume. Actor framed attack as retaliation for a May 2026 FBI FLASH on ShinyHunters (one-week demand to revise/remove; “not financially motivated”). recordsAffected 0 (no attested headcount); companyConfirmed false. Update September 23–24, 2026: FBI stated it is aware of a cyber-criminal group claiming compromise of FBIJobs.gov and alleged employee PII impact; “point of breach still undetermined — whether a third-party or the FBI’s enterprise”; actively investigating with third-party providers. Still no confirmation that the full ShinyHunters data-theft narrative is accurate. companyConfirmed remains false. Update September 25–26, 2026: BBC reports agents fearful/angry; samples shared with reporters appear to include names, addresses, phones, badge numbers, spouses, and fitness-for-work medical exam details. FBI still investigating; point of breach undetermined; companyConfirmed remains false for full ShinyHunters data-theft narrative. Update September 26–27, 2026: Reuters (via AsiaOne/JPost) reports ShinyHunters shared samples with reporters that include fitness-for-duty / psychiatric and other medical-evaluation records; group alleges MedLink and Background Investigation Contract Services among compromised services — Reuters could not corroborate those specific systems. Press (e.g. Times of India citing NewsNation) says FBI confirmed it is investigating a cybersecurity incident involving FBIJobs.gov / employee PII impact while still determining whether intrusion was in FBI enterprise systems or a third-party provider. Full ShinyHunters theft narrative and 2–3 TB claim remain unverified; companyConfirmed stays false. Update September 26–28, 2026: TechCrunch citing MS NOW — FBI internal notification declared a “cyber security incident” and told employees their names, addresses, job titles, and Social Security numbers were exposed related to the FBIJobs.gov portal hack. This is the bureau’s first acknowledgement that agent PII was taken (prior public posture was investigating / theft undetermined). companyConfirmed set true based on that staff attestation of PII theft. Actor volume (~60k / 2–3 TB) and MedLink/BEAST system claims remain incompletely corroborated publicly; census still unpublished (recordsAffected 0). DataBreaches.net (Oct 6, 2026) summarized follow-on reporting that the FBI blamed a contractor’s missed patch for the ShinyHunters FBIJobs/PeopleSoft intrusion path — update to existing verified incident; not a new breach row.