FBI Job Portals Stay Offline After ShinyHunters Breach Claims

The FBI’s online job portals remained unavailable after claimed compromises tied to ShinyHunters, Help Net Security reported, leaving two recruiting sites offline while investigators assess assertions that the extortion group accessed applicant and employee data.

The outage covers the bureau’s main applicant portal and its separate special-agent recruiting site.

The FBI had already confirmed last week that it was investigating ShinyHunters’ claim that personal information connected to bureau employees had been compromised.

ShinyHunters told The Register that an Oracle PeopleSoft zero-day, which has not been specified or verified publicly, was the route into the portals.

The group also claimed access to FBI-managed servers on AWS GovCloud and asserted that it stole personnel files covering current, former and aspiring FBI employees.

The claimed motive was not a ransom demand.

The group framed the disclosure as a response to a recent public service announcement that advised victim organizations not to pay ransom demands and included allegations about ShinyHunters.

The group put the claimed exposure in the tens-of-thousands range for agents and would-be employees, and said former personnel’s medical information was included.

The BBC account cited by the source listed several claimed access points: FBIJobs, FBI BEAST for background checks, FBI MedLink for medical records and FBI BICS for investigative information.

Reuters identified one stolen document as containing data on roles of FBI staff in sensitive or little-known bureau units.

The news agency could not verify whether all job assignments were authentic or current, but it matched career details or titles for eight people whose data was leaked against court filings, news articles, public LinkedIn profiles or other online posts.

The extortion group threatened to release the stolen information unless the FBI retracts what ShinyHunters called false allegations.

That keeps the immediate risk centered on exposure of personnel and applicant records, rather than a conventional payment deadline.

The technical backdrop points to Oracle PeopleSoft vulnerability CVE-2026-35273.

Google Cloud and Mandiant analysts published a Friday rundown of renewed ShinyHunters activity involving the flaw, after earlier zero-day exploitation in May and June 2026 against a target set led mostly by academic institutions.

Oracle’s earlier emergency guidance advised organizations to apply the patch or limit PeopleSoft application and web-server reachability to trusted internal networks.

Temporary mitigation included blocking external access to vulnerable endpoints at the network perimeter or firewall level.

Mandiant warned at the time that relying only on Web Application Firewall body-inspection rules was insufficient because those controls could be bypassed.

The newer campaign showed the same control gap in practice: ShinyHunters modified the original exploit to bypass WAF rules that blocked the vulnerable Environment Management Hub endpoint.

The bypass used URL encoding for a single character in the request path, changing PSEMHUB into /%50SEMHUB/.

That technique allowed traffic to reach systems whose operators may have believed the WAF rule had contained the exposure.

Mandiant’s latest assessment described a wider target set spanning universities, technology companies, IT services, healthcare, agriculture, transportation and government bodies.

After access, the group deploys web shells, uses the legitimate MeshAgent remote monitoring and management tool, and performs fileless command execution.

For the FBI portals, the public status remains unresolved: the sites are offline, the PeopleSoft zero-day claim is still unconfirmed, and the defensive lesson rests on whether affected organizations patched the underlying vulnerability rather than depending on WAF rules alone.