The FBI jobs-site incident has moved beyond an investigation of a hacker group’s claim. The bureau now describes a cyber incident involving FBIJobs.gov, affected people are being notified according to ABC News, and NPR reports that some stolen material has been authenticated. The full number of affected people and the technical entry path remain unresolved in the public evidence.

Updated October 1, 2026: This article incorporates the FBI’s official statement and subsequent reporting through September 30. It also separates the Pentagon’s newly disclosed DMDC breach from the FBI incident; public reporting does not establish a connection between them.

TL;DR

  • On September 22, ShinyHunters claimed it had stolen FBI personnel and applicant records. 404 Media reported seeing a sample of 5,000 alleged agents’ records.
  • The FBI now acknowledges a cyber incident involving its jobs portal. New reporting supports personnel data theft, but does not establish that every employee or applicant record was stolen.
  • The alleged new PeopleSoft zero-day and the full scope remain unverified. A documented PeopleSoft campaign provides defensive guidance, not proof of the FBI entry path.
  • ShinyHunters now says it will not publish the data. That assurance does not establish deletion or remove the risk to employees and their families.

What Has Been Reported

The group posted its claim after objecting to a May 15 FBI advisory about ShinyHunters’ tactics following the Canvas learning-management-system attack. The advisory warns that extortion groups can use both real and exaggerated claims of access to pressure victims. ShinyHunters says it wants the FBI to retract or change that notice. The group’s stated motive is part of its public messaging, not an independent explanation of the incident.

404 Media’s original report says a sample supplied to the newsroom contained names, home addresses, phone numbers, and information about spouses of 5,000 alleged FBI personnel. That sample alone could not establish the full scope. Subsequent reporting provides stronger evidence of genuine personnel data exposure, but still does not substantiate the phrase “almost all.”

CyberScoop reported that the FBI jobs site was temporarily defaced and that its application portal was unavailable. The bureau’s statement was narrower: it was investigating claims of unauthorized activity affecting FBIjobs.gov. The Hacker News also reported a ShinyHunters representative’s assertion that a new Oracle PeopleSoft vulnerability provided entry. No public technical evidence in these reports establishes that a new zero-day was used. A previous ShinyHunters PeopleSoft campaign is not proof that the same path explains this event.

What Changed After the Initial Report

The FBI’s September 23 official statement explicitly left open whether the point of breach was a third party or the FBI’s own enterprise. In a later statement reported by NPR on September 30, the bureau acknowledged a cyber incident involving FBIJobs.gov and said it was communicating with potentially affected people. NPR reported that media organizations and threat intelligence researchers had authenticated some stolen material. That strengthens the evidence of real data theft without validating the group’s entire claimed dataset.

ABC News reported on September 28 that the FBI had sent employees a notice the previous Friday and was operating as if every employee’s personal information had been compromised. Notifications to affected employees had begun, and the FBI described the impacted system as unclassified. Treating everyone as potentially affected is a protective response assumption; it is not a confirmed count of stolen records. Unclassified personnel data can still expose homes, families, and sensitive assignments.

404 Media reported on September 23 that the exposed personnel information included members of the FBI’s Remote Operations Unit, which develops tools for accessing target devices. This is a reported finding about personnel exposure, not evidence that the unit’s exploit tooling or operational systems were compromised.

On September 28, ShinyHunters told 404 Media it would not publish the data. This is an attacker statement, not evidence that copies have been destroyed or that others cannot obtain them. Response decisions should follow the exposed data and affected people, rather than the group’s current messaging.

The Pentagon Breach Is a Separate Incident

The newly reported Pentagon incident concerns the Defense Manpower Data Center (DMDC). BleepingComputer’s report describes unauthorized access through a vulnerability in a file-sharing system between October 2025 and July 2026. ABC News, citing a defense official, reports 2.76 million living people and 294,000 deceased people affected, with exposed information including Social Security numbers and job details.

Those dates and systems differ from the September FBI jobs-site incident. Neither report establishes a shared attacker, a shared vulnerability, or a connection to Oracle PeopleSoft. The common defensive concern is concentrated personnel information; the Pentagon figures must not be used as an updated count for the FBI breach.

What the PeopleSoft Research Establishes

Google Threat Intelligence Group and Mandiant’s September 25 research documents renewed exploitation of CVE-2026-35273 by UNC6240, tracked as ShinyHunters. Attackers used /%50SEMHUB/ to bypass rules matching only /PSEMHUB/; %50 decodes to P. The report does not identify this as the FBI incident’s entry path.

Oracle’s advisory, first released June 10, lists PeopleTools 8.61 and 8.62 and describes unauthenticated remote code execution. Administrators should use its mitigation and installation instructions for their deployment. This known vulnerability must not be relabeled as a newly proven FBI zero-day.

For PeopleSoft owners, Mandiant recommends applying the security alert and disabling or removing unused EMHub exposure. Operators should confirm the change on every serving node and test that administrative endpoints are inaccessible from untrusted networks while required internal workflows still function. Hunt for encoded paths, unexpected JSP files, and shells spawned by WebLogic Java. A clean file scan alone cannot exclude fileless execution. Where compromise is found, preserve evidence and rotate credentials accessible to the application tier. These are campaign response actions, not findings from an examination of FBI systems. Our PeopleSoft response guide provides further context.

The Boundary Worth Examining

A jobs portal may hold applicant records and connect to human-resources systems. Those relationships make the incident consequential while the full scope remains unresolved. Investigators need to determine which application was accessed, what identities and integrations it could use, which data was read or exported, and whether access crossed from the portal into other FBI systems. A defaced page proves a visible change to that page; it does not, on its own, prove bulk data theft.

For any organization running recruitment services, this is a useful tabletop scenario. Inventory the portal’s application accounts, API connections, storage, and administrative access. Ensure application, identity, and database logs can answer who accessed applicant data and in what volume. If suspicious access is found, preserve logs and relevant system images, revoke affected sessions and integration credentials, then scope data exposure before notifying people. Do not wait for a leak-site post to become the first inventory of what the portal could reach.

For recruitment and HR service owners, the operational recommendations are to restrict application accounts to the records and integrations they need, separate public recruitment functions from administrative interfaces, and remove unnecessary copies of personnel exports. Verify the boundaries with authorized access tests: a portal service account should fail to read unrelated HR tables or storage, and an untrusted client should fail to reach administrative endpoints. Confirm that audit logs identify the account, dataset, and export volume. These controls reduce the potential reach of a compromised portal; they are not a claim about the FBI’s configuration.

Personnel exposure also needs a response owner outside IT. HR and security teams should establish a verified contact channel for current and former staff, explain what is known about affected data, and route threats involving homes or families to the appropriate protective team. Confirm that former employees can receive notices and report suspicious contact. Employees should verify unexpected requests through an established channel rather than through contact details supplied in the message. Password changes cannot recover leaked addresses or identity numbers; MFA does not remediate an unauthenticated application vulnerability.

As of October 1: the evidence supports an acknowledged FBI jobs-portal cyber incident and reported theft of authentic personnel information. It does not establish a final victim count, a complete inventory of stolen data, or a verified entry path. The separate Pentagon disclosure and the documented PeopleSoft campaign do not close those gaps.

Sources