FBI Investigates ShinyHunters Claim of Employee Data Theft Using Oracle PeopleSoft Zero-Day

ShinyHunters has given FBI Director Kash Patel and FBI Cyber Division Deputy Director Brett Leatherman one week to respond to its demands, warning that it could expose sensitive employee data if the request is not met.

ShinyHunters Claims It Used an Oracle PeopleSoft Zero-Day

Few details have been released about how ShinyHunters allegedly accessed the data. The group told The New York Times that it “weaponized a zero-day,” or previously undiscovered computer bug, in Oracle PeopleSoft software. PeopleSoft is used by businesses for human resources and financial management.

According to the report, Oracle has not publicly commented on the alleged vulnerability. ShinyHunters said it plans to continue using the zero-day for the company’s “normal business operations.”

FBI Investigates the Alleged Hack

The FBI has not confirmed that a breach occurred, but it has begun investigating ShinyHunters’ claims. In a post on X, the agency said it had not yet determined whether the alleged compromise involved a third-party provider or an FBI company.

The FBI said it is “actively and proactively investigating this matter” and working closely with third-party providers that support its job sites to mitigate potential risks while the investigation continues.

Sources within the FBI told Bloomberg that the job site remained inaccessible as of Wednesday. FBI staff members also received an email warning them to take steps to protect themselves during the investigation.

Hackers Threaten to Publish the Data

ShinyHunters has not said what would happen if the FBI fails to meet its deadline. However, cybersecurity experts told The New York Times that the group would likely publish the allegedly stolen data online.

“I cannot comment on what the FBI will do if they do not respond to the request,” ShinyHunters said in an email to the newspaper. “We are not forcing the FBI and we reiterate that this is not financially motivated.”

“Our intent, goal and motivation is simply to set the record straight,” the group said.