cyber.hendryadrian.com
Cyber Attack & Data Breach · securityonline.info

ShinyHunters Claim They Breached FBI Systems and Stole Personnel Data

· Original article ↗

Summary

ShinyHunters alleges it exploited an unpatched Oracle PeopleSoft vulnerability to access FBI systems and steal personnel and applicant data. The FBI says it is investigating but has not confirmed an intrusion or data compromise.

Key points

  • ShinyHunters claims it exploited an undisclosed Oracle PeopleSoft zero-day to enter FBI systems.
  • The group alleges it moved laterally into the FBI-administered AWS GovCloud environment and exfiltrated 2–3 terabytes of data.
  • The claimed data includes records on current and former FBI employees and job applicants.
  • ShinyHunters says the attack was retaliation for an FBI security alert about the group.
  • The FBI acknowledged awareness of the allegation and says an investigation is underway; it has not confirmed an intrusion or data loss.
  • Oracle and AWS had not publicly responded at the time of the article.

Article Details

Victim Organization
Federal Bureau of Investigation (FBI)
Incident Type
Claimed network intrusion and data theft through exploitation of an undisclosed zero-day vulnerability capable of remote code execution
Data Types Exposed
  • Allegedly detailed profiles and internal records of active and former employees
  • Allegedly prospective job applicants' resumes and other recruitment documentation
Affected Records
Not disclosed
Affected Data Size
Two to three terabytes, according to the attackers' estimate
Operational Impact
The attackers claimed access to internal systems, compromise of the recruitment portal, and lateral movement into cloud infrastructure. No operational disruption was confirmed. A spokesperson reportedly acknowledged the allegation and said an investigation was underway, without confirming intrusion or data compromise.
Ransom Or Extortion
The attackers stated that the alleged attack was retaliation rather than financially motivated. They said they had previously demanded that the victim amend or retract a security alert within one week. No monetary ransom demand was reported.
Claim Status
claimed

MITRE ATT&CK

T1530 · Data from Cloud StorageThe attackers claimed to have extracted two to three terabytes of sensitive personnel and applicant data from the victim's AWS GovCloud environment; the data theft remains unconfirmed.

Threat Actors

ShinyHuntersClaimed to have compromised FBI systems through an undisclosed Oracle PeopleSoft vulnerability and stolen personnel and applicant data. The group characterized the alleged attack as retaliation for an FBI security alert; the compromise and theft were not confirmed.

Vendors

AWSCurrently, the FBI, Amazon Web Services, and Oracle have all abstained from issuing official responses regarding this alleged security incident.OracleThey did this by exploiting an undisclosed Oracle PeopleSoft vulnerability.

Products

AWS GovCloudAfter penetrating the internal FBI network through this exploit, the adversaries laterally navigated into the AWS GovCloud environment administered by the Bureau.Oracle PeopleSoftThey did this by exploiting an undisclosed Oracle PeopleSoft vulnerability.

Related Articles