ShinyHunters Claim FBI Data Theft and Website Defacement; FBI Investigates
Summary
ShinyHunters claim they stole data on about 38,000 FBI staff and applicants and briefly defaced the FBI jobs site. The FBI is investigating; the group says the action was retaliation for an FBI advisory, not extortion.
Key points
- ShinyHunters claimed they obtained information about roughly 38,000 FBI staff and job applicants, including personal and employment details; the claim remains unverified.
- The FBI said it is actively investigating the allegations.
- The group said it briefly defaced the FBI recruitment site; a maintenance message later appeared.
- A ShinyHunters spokesperson reportedly attributed the access to a new Oracle PeopleSoft zero-day, but the article does not independently verify the claim.
- The group later said it was not seeking payment and wanted the FBI to withdraw a prior advisory; it gave the FBI five days to respond.
- ShinyHunters’ reported methods include voice phishing to steal credentials and MFA codes, exploiting misconfigured Salesforce Experience Cloud permissions, and stealing integrator tokens.
- If the claimed data theft is confirmed, exposed personnel information could be used to target FBI staff and applicants.
Article Details
- Event Type
- ShinyHunters claimed to have accessed and stolen data from the FBI recruitment website and defaced it; the FBI is investigating the allegations.
- Impact
- ShinyHunters claimed the data relates to approximately 38,000 FBI staff members and potential recruits and includes names, roles, badge numbers, home addresses, phone numbers, and spouse information. If obtained, the data could expose FBI personnel and recruits to targeting. The article does not confirm the breach or report that the data was released.
Threat Actors
Cl0pDescribed as a rival group whose leak site ShinyHunters claimed to have breached and defaced.LAPSUS$The article reports overlap between ShinyHunters and Lapsus$ under the “Scattered Lapsus$ Hunters” banner.Scattered SpiderThe article reports overlap between ShinyHunters and Scattered Spider under the “Scattered Lapsus$ Hunters” banner.ShinyHuntersGroup that claimed responsibility for accessing FBI recruitment data and defacing the website; the article describes the breach as alleged and under FBI investigation.
Products
Oracle PeopleSoftIn 2025 the group moved to large-scale campaigns against SaaS platforms, mainly Salesforce, along with Oracle PeopleSoft and third-party integrations.Salesforce Experience Cloudtechnique they have used which has been successful against multiple victims is exploitation of Salesforce Experience Cloud where they conduct scans for misconfigured guest-user profiles with too many API permissions,