ShinyHunters claims FBI hack: 'This is NOT financially motivated'

ShinyHunters claims it successfully hacked the FBI and acquired more than 2 TB of employee data, but insists the attack was not financially motivated. The hacker group issued a statement to The Register, clarifying their intentions. "This is NOT financially motivated," a ShinyHunters spokesperson said. "We want the FBI to correct or retract their statements which included substantial false allegations."

The FBI has not yet commented on the claim. ShinyHunters exploited an Oracle PeopleSoft zero-day vulnerability on the FBI jobs webpage, granting remote code execution (RCE) on the servers. Following the breach, the group defaced the website with a message, stating it had been seized by ShinyHunters. Presently, the site is down for maintenance but is expected to be back soon.

The hacker group also claims to have moved laterally onto the FBI’s managed servers on AWS GovCloud, downloading between 2 TB and 3 TB of data from current, former, and prospective FBI employees. ShinyHunters asserts they have access to data from all FBI employees and applicants. The compromised FBI services include human resources, MedLink, and Criminal Justice Information Services.

Neither Oracle nor AWS responded to inquiries regarding the alleged zero-day exploit and data theft. ShinyHunters did not seek an extortion payment from the FBI but instead demanded that the agency retract false statements made about the group in a May 15 bulletin following a previous cyberattack on ed-tech company Instructure’s Canvas platform.

The FBI accused ShinyHunters of harassment, including threatening texts, phone calls, and possible swatting. The security alert also noted that extortionists may falsely claim to possess compromising information, such as embarrassing photos or videos, which are often fabricated. ShinyHunters denies these allegations, stating they are working to refute them.