FBI investigates alleged ShinyHunters breach affecting thousands of agency employees

The FBI is urgently investigating allegations that a hacking collective known as ShinyHunters has accessed sensitive employee records affecting thousands of agency personnel. The group has reportedly issued a one-week ultimatum to FBI leadership, demanding action on an unspecified matter or threatening to release the data publicly.

The Claims#

ShinyHunters stated they exploited a previously unknown vulnerability—a zero-day—within Oracle PeopleSoft, human resources and payroll software widely deployed across enterprises. According to the group's account to journalists, the flaw allowed them to gain unauthorized access to FBI employee information. Oracle has not yet commented on the alleged vulnerability, while the hackers indicated they intend to leverage the same weakness for continued operations.

The group directly contacted FBI Director Kash Patel and FBI Cyber Division Assistant Director Brett Leatherman, establishing a seven-day timeline to comply with unspecified demands.

Investigation Status#

The FBI has not yet confirmed whether a breach occurred, but said it has launched an active investigation into the claims. In a Wednesday post on X, the agency acknowledged that "the point of breach is still undetermined—whether a third-party or the FBI's enterprise." The FBI's jobs portal was inaccessible as of Wednesday, and internal emails warned personnel to take protective measures while the probe continues.

A spokesperson told Bloomberg that officials are "actively and aggressively investigating this matter and working closely" with third-party service providers supporting the portal "to mitigate any and all risk."

Group's Motivation Claims#

ShinyHunters denied that the ultimatum constitutes extortion or financial coercion, stating instead that their goal is to "set the record straight." The group provided no further details about what specific outcome would satisfy their demands. Cybersecurity experts quoted by media outlets suggest the most probable outcome of non-compliance is public disclosure of the stolen data.