Story thread

ShinyHunters FBI breach

Authorities are arresting alleged ShinyHunters members while investigating claims the group hacked FBI employee data and extorted victims.

14 stories from 6 sources · since Sep 22

Clio’s read on this thread

ShinyHunters claimed it breached FBI systems via an Oracle PeopleSoft flaw, stealing employee and applicant data and exposing sensitive assignment details. The FBI reportedly treated the incident as potentially broad PII theft, and law enforcement later announced arrests tied to the group. CIOs should care because HR, identity, and public-facing portals can become high-impact targets with legal, operational, and reputational fallout.

Key points

  • ShinyHunters claimed it breached FBI-related services and stole agents’ and applicants’ personal data.
  • Reporting linked the intrusion to an Oracle PeopleSoft zero-day and a defaced FBI jobs site.
  • Reuters said stolen data showed assignments on China, Russia, cartels, cyber, and other issues.
  • An internal memo said the FBI assumed PII for all employees may have been stolen.
  • Later reports said Dutch police, Jordanian authorities, and the FBI made arrests or detentions tied to the case.

Where coverage agrees

  • Coverage agrees ShinyHunters claimed access to FBI-related systems and theft of personnel or applicant PII.TechCrunch · TechMeme · Ars Technica · The Register
  • Coverage ties the breach to Oracle PeopleSoft and other public-facing or HR-related FBI systems.TechMeme · Ars Technica · Krebs on Security
  • Coverage agrees the exposed material included sensitive FBI assignment information involving China, Russia, cartels, cyber, and similar topics.TechMeme
  • Coverage agrees law enforcement later detained or arrested multiple people connected to ShinyHunters, and the FBI said it made multiple arrests.Krebs on Security · The Register · TechCrunch · The Verge · TechMeme
  1. ShinyHunters Extorted Boeing Spin-off Prior to ArrestsKrebs on Security · Oct 7 · Clio 76
  2. FBI confirms 'multiple' arrests related to ShinyHunters hackThe Register · Oct 5 · Clio 65
  3. Sources: ShinyHunters member Saif al-Din Khader, aka "Rey," was detained in Jordan and is cooperating to identify other hackers involved in the FBI breach (Reuters)TechMeme · Oct 3 · Clio 64
  4. Suspected ShinyHunters leader arrested in the NetherlandsThe Verge · Sep 29 · Clio 69
  5. FBI to ShinyHunters: 'We know how to find you'The Register · Sep 29 · Clio 62
  6. Dutch police arrest ShinyHunters hacker accused of planning two murdersTechCrunch · Sep 29 · Clio 60
  7. Dutch police arrest 'security pro' in ShinyHunters probeThe Register · Sep 29 · Clio 66
  8. Internal memo: FBI said it is "operating under the premise" that a threat actor stole PII of all employees; ShinyHunters set a Tuesday deadline tied to demands (New York Times)TechMeme · Sep 28 · Clio 69
  9. Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationKrebs on Security · Sep 28 · Clio 71
  10. ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'The Register · Sep 25 · Clio 71
  11. FBI rushes to investigate if ShinyHunters hack of thousands of employees is realArs Technica · Sep 23 · Clio 73
  12. A sample of FBI data allegedly stolen by ShinyHunters includes granular detail on officials' job assignments on China, Russia, cartels, cyber, and other issues (Reuters)TechMeme · Sep 23 · Clio 58
  13. ShinyHunters claims it used an Oracle PeopleSoft zero-day to hack FBI-related services and steal employee and applicant data; it also defaced the FBI jobs site (Joseph Cox/404 Media)TechMeme · Sep 22 · Clio 77
  14. Hacking group ShinyHunters claims it breached the FBI, stole agents’ and applicants’ dataTechCrunch · Sep 22 · Clio 73
ShinyHunters FBI breach - CIO Daily Brief