Hackers Claim 3TB Breach of FBI Employee Data via HR Software Flaw

The cybercriminal syndicate ShinyHunters claims to have exfiltrated three terabytes of highly sensitive personnel data from the Federal Bureau of Investigation, boasting of a catastrophic breach of federal security. Yet the evidence the group has actually produced amounts to a sample of just 5,000 records, and neither the FBI nor the software vendor involved has confirmed that any intrusion took place.[1][3]

The threat actors assert they bypassed federal defenses using an unpatched zero-day vulnerability in Oracle's PeopleSoft, the human resources platform used by numerous government agencies. According to the group's posts on a dark web forum, the stolen database contains the personal information, medical records, and clearance details of thousands of current and former federal employees.[1][5]

While the scale of the claimed 3-terabyte theft remains unverified, the 5,000-record sample shared by the hackers on September 22, 2026, appears to contain structured HR data. Cybersecurity researchers analyzing the dump noted that the fields match the architecture of a standard PeopleSoft deployment, though it is not yet clear if the data is fresh or aggregated from previous, unrelated breaches.[3]

"If this data is authentic and recent, it represents a significant counterintelligence risk," noted analysts at eSecurity Planet, highlighting that medical and financial records are frequently leveraged for extortion or recruitment by foreign intelligence services. The 5,000-record sample would represent roughly 14 percent of the FBI's estimated 35,000-person workforce if the data proves unique to active personnel.[3]

The FBI has maintained a strict silence regarding the incident. When pressed for comment by Security Magazine on September 23, the bureau declined to confirm or deny the breach, adhering to its standard protocol for ongoing cyber investigations. Oracle has similarly not issued any security advisories regarding a new zero-day flaw in its PeopleSoft architecture.[2]

ShinyHunters has a documented history of exaggerating the scope of its compromises to drive up the price of stolen data, but the group also possesses a track record of genuine, high-profile intrusions. In previous campaigns, the syndicate successfully breached major telecommunications and ticketing companies, often exploiting third-party software integrations rather than attacking primary network perimeters directly.[1][5]

The focus on an HR platform underscores a structural vulnerability in enterprise security. Human resources systems require extensive access to sensitive employee data and must frequently interface with external payroll and benefits providers, creating a broad attack surface. "HR systems are a prime target because they aggregate the most sensitive data an organization holds into a single, often legacy, application," researchers at DoControl explained in a September 25 technical brief.[4]

Legacy software like PeopleSoft, which has been a staple of enterprise and government HR departments for over 20 years, often relies on complex, highly customized deployments. These customizations can make applying security patches difficult and slow, leaving windows of opportunity for threat actors who discover novel exploitation methods before an agency can secure the architecture.[4]

The cybersecurity community is currently monitoring dark web marketplaces to see if the full database is put up for sale or if the initial sample was the entirety of the exfiltrated data. Until the FBI or the Cybersecurity and Infrastructure Security Agency releases a formal incident report, the true extent of the compromise—and the validity of the zero-day claim—remains an open question.[2][3]