The FBI Called Their Bluff. The Hackers Answered With a Zero-Day.

On May 15, 2026, the FBI put out a public warning about the cybercriminal group ShinyHunters. The message was short and pointed: the group inflates the scope of what it steals to pressure victims into paying, and organizations shouldn't pay ransoms based on claims that can't be verified.

Four months later, ShinyHunters answered back. On September 23, the group posted that it had broken into FBIjobs.gov using a still-unnamed zero-day flaw in Oracle's PeopleSoft platform — the same enterprise software family that let the group hit more than 100 universities back in May and June. This time the group says it walked out with two to three terabytes of data covering "almost ALL FBI Agents" and everyone who ever applied for a job there: names, home addresses, phone numbers, Social Security numbers, family members' information, and — through systems the group named as MedLink and PHIRE — medical records and prescription information.

The FBI's response, as of September 24: it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." Five days after the claim surfaced, the Bureau still hadn't determined whether the intrusion point was a third-party vendor or its own enterprise network.

I want to be precise about what's confirmed here and what isn't, because this story is a textbook case of the gap between what an attacker says and what's actually been proven — the same gap I write about in Cyber Risk Is Business Risk. ShinyHunters has not published a CVE number, a technical writeup, or proof of the full data set. Oracle has not confirmed a PeopleSoft zero-day. What has been independently checked: 404 Media reviewed a sample the group provided, covering roughly 5,000 employees, and reported that at least some of it appeared authentic — while noting the data's origin remains unconfirmed. Cato Networks researcher Etay Maor called the claim "unusually provocative" and said it should be taken seriously, without vouching for its scale. Treat the 2-3 terabyte figure, and the "almost all agents" framing, as ShinyHunters' own claim until the FBI or an independent forensic review says otherwise.

A Federal Agency Just Ran the Experiment You Hope You Never Have To

Here's what should get your attention regardless of how the verification shakes out. In May, an agency with essentially unlimited investigative resources looked at a known extortion group and told the public, in writing, that the group's claims are exaggerated. Four months later, that same group claims to have broken into the agency's own recruiting infrastructure. Whether or not every terabyte checks out, the retaliation itself — a targeted, public response to being called a liar — is the story executives should sit with.

I've sat in rooms where a communications team wanted to push back hard on an attacker's claims before the forensics were finished. The instinct is understandable. You want to stop the panic and reassure customers before the story runs away from you. But publicly minimizing what a threat actor says you don't know is true yet — and dismissing what you don't know you don't have wrong — is a bet you're making with your reputation on the table, not just theirs.

Run this through the three questions I ask every board to ask about their own organization:

What are we protecting? The data ShinyHunters claims to hold — names, SSNs, addresses, family details, medical records — is the exact profile most companies carry on their own employees and job applicants. If you think this only matters because the target was a three-letter federal agency, look at your own HR and applicant-tracking systems.

Who is responsible? Oracle's PeopleSoft platform sits at the center of this claim for the second time in four months. If your organization runs PeopleSoft, or any enterprise HR platform from a major vendor, the vendor built it — but you own the fallout, the notifications, and the regulatory scrutiny if it goes wrong.

Are we ready when it happens? Five days in, the FBI could not say whether the entry point was third-party or its own network. Most organizations, five days into an incident, are in the same fog — Bureau included. "We'll figure out attribution before we say anything" is a plan, not a stall tactic, as long as you actually have people doing the figuring.

The Dare Nobody Should Take

Here's the piece I keep coming back to. The FBI didn't get breached because it called ShinyHunters exaggerators. Causation isn't established, and may never be. But the sequence — public dismissal, then a targeted response naming that exact dismissal as the motive — is a pattern worth planning around. If your organization is ever in a position to publicly characterize an attacker's claims as overblown, make sure the people signing off on that message have seen the forensic evidence, not just the incident report summary. A statement that turns out to be wrong doesn't just embarrass your comms team. It becomes the thing the next attacker points to.

What to Ask Your CISO This Week

• If we ran an HR platform from a major enterprise vendor — PeopleSoft, Workday, SAP SuccessFactors — would we know within 24 hours if that vendor had an unpatched zero-day affecting us?
• Who has authority to approve a public statement characterizing an attacker's claims, and do they have to clear it with the forensics team first?
• If we discovered a breach today, how long would it take us to determine whether the entry point was a vendor, a cloud environment, or our own network? Five days, like the FBI? Longer?
• Do we hold medical, prescription, or dependent/family data on employees or applicants anywhere outside our core HR system, and who's tracking that inventory?

I'll follow this one as it develops, because the gap between what's claimed and what's confirmed is going to close one way or another. Until it does, the lesson isn't about the FBI. It's that if a federal law enforcement agency can spend five days not knowing where its own breach started, you should assume your organization would take at least as long — and plan your first week accordingly.