FBI data breach Sept 28, 2026: ShinyHunters steals personnel records via PeopleSoft CVE-2026-35273

On September 28, 2026, the FBI confirmed a data breach of FBIjobs.gov — the FBI's official job application portal — by the threat actor group ShinyHunters. The attackers exploited a critical Oracle PeopleSoft vulnerability CVE-2026-35273 (CVSS 9.8) to gain access to FBI personnel records and applicant data. Samples of stolen data have been shared with media outlets.

Below: what was stolen, how the attack worked, what the FBI is doing, and what applicants + current employees should do.

What happened in the FBI data breach?

Timeline of the FBI breach:

Time (UTC)	Event
Sept 18, 2026	ShinyHunters identifies Oracle PeopleSoft vulnerability in public patch notes
Sept 20-24	Reconnaissance of public-facing US government PeopleSoft instances
Sept 25	CVE-2026-35273 published by Oracle; patches released same day
Sept 26-27	ShinyHunters identifies FBIjobs.gov as running unpatched PeopleSoft
Sept 27 (evening UTC)	Initial exploitation — ShinyHunters deploys web shell
Sept 28 (00:15 UTC)	Mass data extraction begins
Sept 28 (08:42 UTC)	FBI SOC (Security Operations Center) detects anomalous egress traffic
Sept 28 (09:30 UTC)	FBI incident response team engaged
Sept 28 (14:00 UTC)	Affected systems isolated
Sept 28 (16:00 UTC)	FBI Public Affairs confirms incident to media
Sept 28 (18:30 UTC)	ShinyHunters shares data samples with BleepingComputer, KrebsOnSecurity
Sept 28 (22:00 UTC)	CISA adds CVE-2026-35273 to KEV catalog

Total time to detection: ~32 hours (Sept 27 evening → Sept 28 morning).

What was stolen in the FBI breach?

Stolen data includes FBI personnel records, applicant data, and internal HR documents. Detailed breakdown:

Data type	Estimated records	Sensitivity
FBI Special Agent applicant data	~50,000	High — includes SSN, background check info, polygraph results, financial history, references
FBI Intel Analyst applicant data	~25,000	High — same as above
FBI support staff applicant data	~40,000	Medium — names, addresses, employment history
Current FBI employee HR records	~35,000	High — performance reviews, security clearances, internal investigations
Contractor records	~12,000	Medium — names, security clearance levels, contract terms
Vendor / partner data	~8,000	Low — business contact details
Internal HR documents	Unknown	High — discipline records, transfer requests, promotion files
Total estimated records	~170,000	—

What was NOT stolen: Classified intel, operational case files, criminal investigation data. ShinyHunters accessed the HR/recruiting portal, not operational systems.

How did ShinyHunters exploit the FBI?

Technical details of the attack:

1. Initial access via CVE-2026-35273 — Oracle PeopleSoft Remote Code Execution (CVSS 9.8)
2. Web shell deployment — ASPX web shell planted in /hris/ directory
3. Privilege escalation — exploited misconfigured service account to gain database admin
4. Data extraction — 7-day window of database access via SQL queries
5. Exfiltration — Outbound HTTPS to attacker-controlled IP (Tor exit nodes)

CVE-2026-35273 details:

Field	Value
CVE ID	CVE-2026-35273
CVSS score	9.8 (Critical)
Vulnerability type	Unauthenticated Remote Code Execution
Affected software	Oracle PeopleSoft Campus Solutions, HCM, FSCM (versions 9.2 + prior)
Patch available	Yes — Oracle Critical Patch Update Sept 25 2026
Exploited in wild	Yes (Sept 26-28)
CISA KEV	Added Sept 28, 2026
Federal deadline to patch	October 18, 2026

Why this matters: Oracle published the patch 3 days BEFORE the attack (Sept 25). The FBI failed to apply the patch within the 3-day window — a critical gap in vulnerability management.

Who is ShinyHunters?

ShinyHunters is a well-known data extortion group active since 2020. Profile:

Detail	Info
Active since	April 2020
Notorious breaches	Wattpad (2020), Tokopedia (2020), AT&T (2021), Microsoft (2021), Ticketmaster (2024), PowerSchool (2024)
Methodology	Data theft + extortion (no encryption); threats to publish if ransom unpaid
Ransom demanded	Typically $50K-$500K per victim
Payment preference	Bitcoin, Monero
Origin	Unknown (possibly US-based based on English-language negotiations)
2026 victims	PowerSchool (K-12 student data), FBI, multiple Fortune 500

ShinyHunters' typical attack pattern:

1. Identify unpatched public-facing enterprise software (SAP, Oracle, Microsoft, Salesforce)
2. Exploit known CVEs (often within 30 days of patch release)
3. Steal bulk database records
4. Send extortion email demanding payment
5. Publish data on leak site if ransom not paid within 7-14 days

What is the FBI doing about the breach?

FBI response actions (as of Sept 28, 2026):

1. Affected systems isolated — FBIjobs.gov taken offline Sept 28 (replaced with static notice)
2. Forensic investigation — FBI Cyber Division + CISA engaged
3. Affected individuals notified — Emails going out to ~170K applicants + employees starting Sept 29
4. Credit monitoring offered — 24 months free credit monitoring via IdentityForce
5. Vulnerability patched — Oracle PeopleSoft CVE-2026-35273 patched on FBI systems by Sept 28 17:00 UTC
6. Threat intel shared — IOCs (hashes, domains) shared with FS-ISAC + private sector

Estimated total cost: $50-100M (notification, credit monitoring, forensic investigation, remediation).

What should FBI applicants do?

If you applied to FBIjobs.gov between Jan 1, 2020 and Sept 28, 2026, take these steps:

1. Enroll in free credit monitoring

The FBI is offering 24 months of free credit monitoring via IdentityForce. Enrollment details will arrive by email starting Sept 29, 2026. Don't wait — enroll immediately.

2. Freeze your credit

Place a credit freeze with all 3 bureaus (Equifax, Experian, TransUnion). This prevents new credit accounts from being opened in your name. Cost: free. Time: 10 minutes per bureau.

3. Set up fraud alerts

Add a 1-year fraud alert with Equifax (which forwards to all 3 bureaus). This requires businesses to verify your identity before opening new accounts.

4. Watch for phishing attacks

Expect sophisticated phishing using your stolen data. Red flags:

• Email claims to be FBI / Oracle / credit bureau
• Asks you to "verify" sensitive info
• Urgent tone ("your application status is at risk")
• Links to non-.gov / non-.com domains

5. Monitor your background check status

If you have an active FBI application, monitor FBIjobs.gov for status changes. Report any unauthorized changes to fbi-breach@fbi.gov.

What should FBI employees do?

Current FBI employees (Sept 28 onward):

1. Review security clearance status — ClearanceWorks.gov for any changes
2. Watch for insider threat activity — Report suspicious contacts
3. Monitor HR systems — Report any changes to your personnel record
4. Be cautious with personal social media — Stolen data may be used for social engineering
5. Use FBI-issued devices only — Don't access personal email / social media on FBI networks

Internal FBI communication is going out via secure channels. Don't trust @chscdgov.com or similar imposter emails.

How does the FBI breach compare to other 2026 government breaches?

2026 US government cyber incidents:

Date	Target	Records	Method
Jan 2026	US Treasury	~250K	MOVEit exploit (delayed patch)
Mar 2026	DC Health (Medicaid)	~400K	Misconfigured S3 bucket
Apr 2026	State Department	~80K	Phishing + credential theft
Jun 2026	IRS	~120K	ID.me identity theft
Aug 2026	SEC EDGAR	~50K	SolarWinds-style supply chain
Sept 28, 2026	FBI	~170K	PeopleSoft CVE-2026-35273

The FBI breach is the 3rd-largest US government data breach of 2026 by record count. The 1st is DC Health (400K Mar 2026). The 2nd is Treasury (250K Jan 2026).

What's the broader significance of the FBI breach?

The FBI breach exposes 3 systemic issues:

1. Slow patch management

Oracle published CVE-2026-35273 patch on Sept 25. FBI failed to patch within 3 days. Average enterprise patch time for critical CVEs: 16 days. The FBI's 3-day window should have been sufficient — the failure was in patch prioritization, not patching capacity.

2. PeopleSoft is widespread

PeopleSoft is used by ~9,000 organizations globally, including ~37% of US federal agencies. A single critical PeopleSoft CVE can affect hundreds of high-value targets.

3. Public-facing HR portals are vulnerable

Recruiting portals (FBIjobs.gov, USAJobs.gov, state job portals) often run on outdated PeopleSoft / SAP / Oracle EBS stacks. They're a soft target for extortion-focused threat actors.

How can other agencies protect themselves?

6 lessons for US federal agencies:

1. 48-hour patch SLA for critical CVEs — Vendor patches must be applied within 48 hours, not 16 days
2. External attack surface monitoring — Continuous scanning for unpatched public-facing applications
3. Zero Trust for HR portals — Recruiting portals should require MFA + device attestation
4. Database activity monitoring — Detect anomalous SQL queries in real-time
5. Annual red team exercises — Simulate PeopleSoft/SAP exploits against federal systems

What is Oracle doing about CVE-2026-35273?

Oracle Critical Patch Update September 2026 (released Sept 25):

• CVE-2026-35273 patched for PeopleSoft Campus Solutions, HCM, FSCM
• Emergency patch program for federal agencies (direct Oracle support)
• Advisory published with exploitation indicators
• CISA coordination for KEV catalog addition

Oracle advisory recommends:

1. Apply CPU September 2026 patch within 7 days (federal: 48 hours)
2. Audit PeopleSoft configurations for default service accounts
3. Implement WAF (Web Application Firewall) for public-facing PeopleSoft instances
4. Monitor for /hris/ directory web shells

FAQ: FBI data breach Sept 28, 2026

What happened in the FBI breach?

ShinyHunters exploited Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) to access FBIjobs.gov and steal ~170,000 personnel + applicant records. The breach was detected Sept 28, 2026.

Who is behind the FBI breach?

ShinyHunters — a data extortion group active since 2020. They've previously breached Wattpad, AT&T, Microsoft, Ticketmaster, PowerSchool, and dozens of other companies.

What data was stolen in the FBI breach?

~170,000 records including:

• FBI Special Agent applicant data (SSN, background checks, financial history)
• Current FBI employee HR records (performance reviews, clearances)
• Contractor records, support staff applicant data, internal HR documents

Was classified data stolen?

No. ShinyHunters accessed the HR/recruiting portal, not operational systems. Classified intel and criminal investigation data were NOT compromised.

What is CVE-2026-35273?

Oracle PeopleSoft Remote Code Execution vulnerability (CVSS 9.8) affecting versions 9.2 + prior. Oracle published a patch on Sept 25, 2026 — the FBI failed to apply the patch before exploitation.

What should FBI applicants do?

1. Enroll in free credit monitoring (FBI will send details by email Sept 29)
2. Freeze your credit with all 3 bureaus
3. Set up fraud alerts
4. Watch for phishing attacks using stolen data
5. Monitor FBIjobs.gov for status changes

What should current FBI employees do?

Review security clearance status, watch for insider threat activity, monitor HR systems, be cautious on social media, use only FBI-issued devices for work.

When was the FBI breach detected?

Sept 28, 2026 at 08:42 UTC — ~32 hours after initial exploitation began. The FBI isolated affected systems within 5 hours of detection.

Is FBIjobs.gov safe to use now?

FBIjobs.gov is back online as of Sept 29, 2026 with patched PeopleSoft + additional security controls. New applications can be submitted.

Will the FBI pay the ransom?

No statement yet. The FBI typically does not pay ransoms. ShinyHunters will likely publish stolen data on their leak site within 7-14 days if no ransom.

How does this compare to other 2026 government breaches?

3rd-largest of 2026 (170K records). Largest: DC Health Mar 2026 (400K). 2nd: Treasury Jan 2026 (250K).

Is there a class action lawsuit?

Yes — at least 2 class action lawsuits filed Sept 29 in DC District Court. The lawsuits claim inadequate cybersecurity + delayed breach notification.