ShinyHunters, the FBI and PeopleSoft: arrests and a missed patch

📌 Later developments: ShinyHunters: ransom negotiator arrested in the US (October 10, 2026)

In the second half of September the data theft and extortion group ShinyHunters breached FBIJobs.gov, the FBI’s recruitment portal, and claimed to have stolen personal data on current, former and prospective employees. The FBI now confirms multiple arrests linked to the attack and points to the cause: a security patch that a third-party contractor did not apply on a platform it managed.

For anyone running business systems, the technical takeaway is this: a high-profile attack succeeded through a vulnerability that had already been fixed, on a system managed by a third party.

What happened

According to The Register, the group said the FBI attack was not financially motivated: it wanted to hit back at the notice in which, on 15 May 2026, the FBI advised victims not to pay. A spokesperson called it “a public relations and marketing initiative” for the group’s business.

According to Reuters, as reported by KrebsOnSecurity, the exposed data concerns more than 5,000 FBI personnel and includes unit, specialisation and even medical and psychiatric records.

Brett Leatherman, assistant director of the FBI’s Cyber Division, told Reuters that the incident resulted from a security failure of a platform managed by a third-party organisation, after a contractor failed to install a patch issued specifically to secure it. The FBI has removed the contractor. The FBI named no names; according to two Reuters sources, cited by CSO Online and KrebsOnSecurity, the third party is Accenture and the platform is Oracle PeopleSoft, the hiring, HR and payroll system that ShinyHunters had already named as its way in.

On the investigation side:

• on 15 September Dutch police arrested a 24-year-old, previously convicted of data theft and extortion, whom the FBI describes as “one of the alleged leaders” of ShinyHunters;
• at the end of September Jordanian authorities detained a young man in Amman known by the alias Rey, who according to Reuters is cooperating with the FBI to identify other members;
• on 5 October the FBI told The Register that it had worked with partners to arrest “multiple subjects”, without giving details.

According to KrebsOnSecurity, when Rey was detained the group was trying to extort Jeppesen ForeFlight, the aviation navigation unit Boeing sold in 2025. Boeing said it is aware of the claims and is reviewing them; Jeppesen ForeFlight says it has seen no impact on its operations or products.

Technical details

• Vulnerability: according to KrebsOnSecurity, the group got into the FBI’s system and those of other victims by exploiting CVE-2026-35273 in Oracle PeopleSoft. It has been exploited as a zero-day since June; Oracle released a fix shortly afterwards.
• Bypassed mitigation: for organisations that could not patch quickly, Mandiant had published web application firewall (WAF) rules. In recent weeks ShinyHunters bypassed them with a well-known URL-encoding trick.
• Mass exploitation: in a report dated 25 September, Mandiant and the Google Threat Intelligence Group confirm that the group exploited the vulnerability at scale, stealing data from dozens of systems in higher education, technology, healthcare, agriculture, transportation and government.
• Operating model: according to sources close to the investigation cited by KrebsOnSecurity, ShinyHunters now works like a franchised brand. Affiliates supply stolen credentials for SaaS platforms used by large companies and receive a share of the ransoms.
• Pressure on victims: the FBI notice of 15 May describes threatening messages and calls to victims and their families, cases of swatting and false claims of holding compromising material.
• MITRE ATT&CK (mapped from the reported facts): T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts) for access with stolen credentials, T1657 (Financial Theft) for the extortion.

Impact for European and Italian companies

PeopleSoft is also widely used in Europe for workforce management. The data it holds (personal records, salaries, health data) often falls under the GDPR’s special categories: a breach means assessing notification to the supervisory authority within 72 hours and, in the most serious cases, informing the people concerned.

Above all, the FBI case is about the supply chain. NIS2 requires essential and important entities to manage supplier security and vulnerability handling; a system you hand over to a supplier is still your risk. Healthcare is among the affected sectors, and there HR systems are tied to shifts and clinical access.

What to do right now

1. Take inventory: list every PeopleSoft instance, including those hosted or managed by suppliers and outsourcing companies.
2. Verify the patch, with evidence: ask your supplier for the actual patch level against Oracle’s fix for CVE-2026-35273. A generic statement is not enough.
3. Do not rely on the WAF alone: the temporary rules have been bypassed. Check that your WAF decodes and normalises URLs before applying rules, and treat it as a stopgap, not a fix.
4. Look for signs of exploitation: review web server and WAF logs for your PeopleSoft instances from June onwards, focusing on requests with encoded paths and unusual data exports. Use the indicators in the Mandiant and GTIG report.
5. Protect SaaS access: multi-factor authentication on every SaaS platform, a review of active sessions and rotation of exposed credentials.
6. Prepare your extortion response: include in your response plan direct contact with employees and their families, reporting to law enforcement and, for NIS2 entities, notification to the national CSIRT.
7. Review contracts: set maximum times for applying critical patches and require suppliers to report their status.

How ARXDOME helps

ARX Expose shows which services your company exposes to the Internet, which products are recognised on them and which have known vulnerabilities, and flags company accounts involved in breaches. ARX Shield lists open vulnerabilities by machine and by package, highlighting those already being exploited. ARX Sentry collects logs from servers and firewalls and groups failed logins and bursts of attempts, which helps you spot stolen credentials in time.

Last updated: 7 October 2026