5,000 Records, One Sentence From the FBI

"We hacked the FBI." That's the entire pitch ShinyHunters posted to its dark-web leak site Tuesday, and it is doing a lot of work for four words.

The group says it broke into FBI-managed systems through an unpatched Oracle PeopleSoft zero-day, moved laterally into AWS GovCloud infrastructure, and walked out with between two and three terabytes of data on current and former employees and job applicants. It handed 404 Media a sample of roughly 5,000 records. Reuters ran names and addresses against credit bureau records and dark-web intelligence archives and found matches in at least ten cases, including details that appeared to correspond to FBI Director Kash Patel.

This isn't a ransom story. It's a hostage story where the hostage is the Bureau's credibility.

The Sentence Built to Say Nothing

The FBI's entire public response: the bureau said it "is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."

Translation: we have seen the tweet. We are not going to tell you if it's true, because true has consequences we're not ready to manage in public.

That sentence confirms FBIjobs.gov had a problem worth investigating, while conceding nothing about scope, volume, or which internal services were touched. ShinyHunters claims the intrusion reached Criminal Justice, HR, and Medlink services. The FBI hasn't addressed that.

ShinyHunters wants the FBI to retract a May 15 advisory describing the group's harassment tactics. That's not a criminal enterprise chasing a payday. It's a criminal enterprise trying to win a public relations dispute with federal law enforcement, using stolen HR data as leverage.

A Second Zero-Day, or the Same Playbook With Better Timing?

This isn't ShinyHunters' first PeopleSoft target. Oracle patched a critical, unauthenticated PeopleSoft PeopleTools flaw, CVE-2026-35273, on June 10 after Mandiant found it had already been exploited in the wild for two weeks. Hackers affiliated with the group had used chained vulnerabilities against roughly 300 PeopleSoft instances across more than 100 organizations before that patch landed.

Now ShinyHunters says it found a fresh, unpatched flaw in the same product Monday night and used it immediately against the FBI. No CVE. No public advisory. No emergency mitigation guidance from Oracle, as of this writing.

If that claim is accurate, the same enterprise HR platform that already burned 100-plus organizations in June has a second hole in it, and the only entity that currently knows the details is the group exploiting it.

You do not need the FBI to confirm a breach to know your exposure. If you run PeopleSoft anywhere in your HR or applicant-tracking stack, the operating assumption should be that an unpatched remote-code-execution path exists right now. Waiting for Oracle's next advisory or the Bureau's next statement is not a security posture. It's a bet that nobody hits you first.

What to watch: an Oracle emergency alert naming a second PeopleSoft CVE distinct from CVE-2026-35273; whether the FBI's "investigating" language upgrades to a confirmed-incident notice under federal breach disclosure rules; a DOJ Inspector General referral; and whether other organizations running PeopleSoft report intrusions in the next two to three weeks that trace back to the same access ShinyHunters says it's already reselling.