FBI Job Portals Remain Offline After ShinyHunters Claims Breach
Summary
FBI job applicant portals remain offline after ShinyHunters claimed access to FBI systems and sensitive data. The FBI is investigating; Mandiant separately reports renewed exploitation of an Oracle PeopleSoft vulnerability. Portals: apply[.]fbijobs[.]gov and fbijobs[.]
Key points
- The FBI is investigating ShinyHunters’ claim that it accessed employee and applicant information; the breach claims have not been independently confirmed in the article.
- The group alleges it stole personnel files and sensitive information, including medical and background-check records.
- The FBI applicant portals at apply[.]fbijobs[.]gov and fbijobs[.]gov/special-agents remain unavailable.
- Reuters reported it could not verify whether all leaked job assignments were authentic or current, though it matched details for eight people to public sources.
- Mandiant says ShinyHunters is again exploiting Oracle PeopleSoft vulnerability CVE-2026-35273, including by URL-encoding a character to bypass string-based WAF rules.
- Mandiant says the campaign targets organizations that relied on WAF rules without patching; the group reportedly deploys web shells and MeshAgent and performs fileless command execution.
Article Details
- Victim Organization
- FBI
- Victim Domain
- fbijobs.gov
- Incident Type
- Alleged breach involving exploitation of an Oracle PeopleSoft vulnerability; the FBI applicant portals were reported offline.
- Data Types Exposed
- Personal information
- Medical information
- Background-check records
- Personnel files
- Investigative information
- Affected Records
- ShinyHunters claimed to have obtained information on tens of thousands of FBI agents and prospective employees; the claim was not independently confirmed in the article.
- Operational Impact
- The FBI job applicant and special agent applicant portals were reported unavailable.
- Ransom Or Extortion
- ShinyHunters said it was not seeking money and threatened to release the allegedly stolen information unless the FBI retracted its allegations.
- Claim Status
- alleged
MITRE ATT&CK
CVE
Threat Actors
Vendors
Products
FBI BEASTAccording to the BBC, the group claims to have gained access to multiple platforms: FBIJobs, FBI BEAST (which handles background checks on employees and applicants), FBI MedLink (which stores medical records), and FBIFBI BICShandles background checks on employees and applicants), FBI MedLink (which stores medical records), and FBI BICS (which contains investigative information).FBI MedLinkmultiple platforms: FBIJobs, FBI BEAST (which handles background checks on employees and applicants), FBI MedLink (which stores medical records), and FBI BICS (which contains investigative information).FBIJobsThe FBI’s online portals for job applicants (at apply.fbijobs.gov) and special agent applicants (at fbijobs.gov/special-agents) are still unavailable, following what appears to be successful compromises by theMeshAgentThe attackers bypass WAF rules and deploy web shells and MeshAgent.PeopleSoftGoogle Cloud / Mandiant says the group is again exploiting Oracle PeopleSoft vulnerability CVE-2026-35273 by bypassing WAF rules and targeting organizations that failed to patch.