The FBI’s online hiring system stayed dark for weeks after it went down. Two portals, apply.fbijobs.gov and the Special Agent Applicant Portal at fbijobs.gov/special-agents, were still unavailable as of October 4, 2026, about a week after Help Net Security first reported both portals down on September 28, 2026. The outage traces back to a claim from the extortion group ShinyHunters, which says it broke into the bureau’s recruitment infrastructure through a previously unknown flaw in Oracle’s PeopleSoft human resources software.
This is not a routine maintenance window. It is the latest entry in a run of high-profile breach claims tied to ShinyHunters and Oracle PeopleSoft, and it lands at a federal law enforcement agency whose own recruitment pipeline now sits frozen while investigators try to work out what actually happened. The story matters beyond the FBI’s HR department: PeopleSoft runs inside thousands of government agencies, universities, and Fortune 500 companies, and a fresh zero-day against it (if confirmed) would be a supply-chain problem, not a one-agency problem.
That core uncertainty began to resolve in early October, and the story has since moved well past the original breach claim. On October 7, 2026, the FBI said an internal review had traced the breach to a security failure by one of its contractors, and confirmed it had removed that contractor and taken steps to limit further risk; the bureau still hasn’t publicly confirmed a scope of exposed data. FBI cyber chief Brett Leatherman later said the contractor had failed to apply a security patch issued specifically to secure the platform, tying the breach to a third-party-managed system rather than a flaw inside the FBI’s own network, and multiple outlets reported the removed contractor worked for Accenture. The case then moved from investigation toward prosecution: on October 8, 2026, the FBI arrested Edward Dubrovsky in Pennsylvania in connection with the hack. ShinyHunters, true to form, kept its broader extortion operation running throughout: the group’s leak site briefly went dark before returning on October 1, 2026, with a fresh batch of unrelated corporate targets.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What happened to the FBI’s job application portals
The timeline, as pieced together from multiple outlets, starts on the night of September 21, 2026. ShinyHunters told BleepingComputer that it exploited an alleged PeopleSoft zero-day that night, then moved laterally into FBI-managed infrastructure. By September 22, both applicant portals displayed a message saying they were unavailable, and a defacement banner reading “This site has been seized by ShinyHunters” reportedly appeared on the jobs site, according to The Hacker News.
The FBI’s jobs portal is the front door for anyone applying to become a special agent, analyst, or support staffer at the bureau. It typically collects names, addresses, employment history, and other personal details from applicants and current employees alike. When it went dark, prospective hires lost the ability to apply, and existing applicants lost visibility into where their files stood in the pipeline.
By September 23, PBS reported the jobs site remained offline while the bureau investigated. Two days later, on September 25, the FBI publicly acknowledged the claims. The outage stretched well past a full week, and both portals remained offline as of October 4, 2026, with no restoration date given even after the FBI’s October 7, 2026 statement on the breach’s cause.
ShinyHunters’ claims: what the group says it took
ShinyHunters is telling a consistent story to multiple outlets, though none of it has been independently verified. The group claims it stole between 2 and 3 terabytes of data covering current and former FBI employees and job applicants. That figure lines up with what ShinyHunters told reporters after a separate, earlier claim regarding FBI systems, suggesting the group may be describing the same haul across different conversations rather than two distinct incidents.
The alleged stolen data reportedly includes names, home addresses, and phone numbers belonging to agents and their spouses, a claim reported by security firm Vectra and summarized on its blog. If accurate, that is a materially different risk profile than a typical corporate breach: exposing home addresses and family details of federal agents raises physical safety concerns, not just identity-theft exposure.
ShinyHunters also told The Register that it moved laterally into what it described as FBI-managed AWS GovCloud infrastructure after the initial PeopleSoft compromise. GovCloud is Amazon’s isolated cloud region built to meet US government compliance requirements including ITAR and FedRAMP High, so a genuine lateral move into that environment would represent a serious escalation beyond a single HR web portal. Again, this claim comes from the attackers, not from independent forensic confirmation.
Asked about motive, ShinyHunters told The Register the operation was “not financially motivated,” an unusual framing for a group that has built its reputation on extortion-for-payment campaigns against dozens of companies over the past two years.
The PeopleSoft zero-day question
The technical core of this story is murkier than the headlines suggest. ShinyHunters says it used a new, previously undocumented Oracle PeopleSoft vulnerability to gain remote code execution on FBIJobs.gov servers. Remote code execution means an attacker can run arbitrary commands on the target system, effectively taking control of it rather than just reading data off it.
Here is the complication: PeopleSoft has already had a real, documented zero-day this year. Google Cloud’s Mandiant team reported in the May-June 2026 window that a flaw tracked as CVE-2026-35273 was actively exploited against academic institutions before a patch existed, according to Help Net Security’s account of that research. ShinyHunters itself has used PeopleSoft flaws before; the group was previously linked to intrusions at more than 100 organizations through an earlier Oracle PeopleSoft weakness, and separately claimed to have found a way to bypass a web application firewall protecting a CVSS 9.8 PeopleSoft bug, a story covered here in detail.
What is not established is whether the FBI intrusion used CVE-2026-35273 specifically, or a genuinely new, unpatched flaw. The Register, BleepingComputer, and Cybersecurity Dive all draw a distinction between the previously documented CVE and ShinyHunters’ claim of “another” PeopleSoft zero-day. As of this writing, no public CVE identifier has been assigned to an FBI-specific PeopleSoft flaw, and the vulnerability has not appeared on CISA’s Known Exploited Vulnerabilities catalog. That absence matters for enterprise security teams: without a CVE and a KEV listing, there is no official patch guidance to act on yet, only a claim from the attackers themselves.
What the FBI has and hasn’t confirmed
The bureau’s public response has been narrow and carefully worded. An FBI spokesperson told The Register: “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII).” That statement confirmed the bureau was investigating a claim. At the time, it did not confirm the claim itself, the scope of any data taken, or the technical method used to get in, questions the bureau would partially answer two weeks later.
As of the September 25 reporting cycle, investigators reportedly had not determined whether the point of entry was a third-party contractor managing the jobs portal or the FBI’s own enterprise environment. That distinction carried real consequences, and it has since been resolved: on October 7, 2026, the FBI said its internal review found that a security failure by one of its contractors, not its own enterprise network, caused the breach. FBI cyber chief Brett Leatherman put it directly: the contractor “failed to implement a security patch explicitly issued to secure the platform,” which placed the fault on a third-party-managed system rather than FBI-controlled infrastructure. The bureau said it had removed the contractor, later reported by multiple outlets to be tied to Accenture, and taken steps to limit further risk, the lower-impact scenario security teams had been watching for rather than a compromise of FBI-managed infrastructure.
The case has since moved beyond an internal review and into a criminal matter: on October 8, 2026, the FBI arrested Edward Dubrovsky in Pennsylvania in connection with the hack. Outside of the arrest, neither the scope of exposed records nor a restoration timeline for the portals has been confirmed by the bureau. The FBI has previously described a related situation this month as a “cyber incident” affecting thousands of personnel records, a separate disclosure detailed in our earlier coverage, though it remains unclear from public reporting whether that notification and the current portal outage describe the same underlying event or two related but distinct incidents inside the same news cycle.
FBI arrests Edward Dubrovsky in Pennsylvania
The case took its most concrete turn yet on October 8, 2026, when the FBI arrested Edward Dubrovsky in Pennsylvania in connection with the ShinyHunters hack. The arrest is the clearest sign so far that the bureau has shifted from describing an open investigation to pursuing a named individual, moving the story from forensic cleanup toward criminal prosecution.
Federal authorities had not published a detailed charging document spelling out Dubrovsky’s alleged role as of this writing, including whether prosecutors allege direct participation in the PeopleSoft intrusion or a supporting role in the broader ShinyHunters operation. What is confirmed is the timing: the arrest landed roughly two and a half weeks after ShinyHunters’ initial claim of breaking into FBI-managed infrastructure on September 21, 2026, and two days after FBI cyber chief Brett Leatherman publicly tied the breach to a contractor’s unapplied security patch.
The arrest doesn’t resolve the open technical questions raised above, namely whether the intrusion relied on a genuinely new PeopleSoft zero-day or a previously documented flaw, and it doesn’t confirm the full scope of data ShinyHunters claims to have taken. What it confirms is that the case has moved well past the claim-and-denial stage that defined its first two weeks, into active federal prosecution.
ShinyHunters’ pattern: a year of PeopleSoft-linked breaches
To understand why security researchers are taking this claim seriously despite the lack of independent confirmation, it helps to look at ShinyHunters’ track record with Oracle’s HR software over the past year. The group first drew attention for PeopleSoft-related activity when it was linked to intrusions across more than 100 organizations through an Oracle zero-day, a campaign reported here earlier this year. It later claimed to have found a way around web application firewall protections shielding a critical PeopleSoft bug rated CVSS 9.8, exploiting the same underlying weakness against different targets.
Separately, ShinyHunters has claimed responsibility for hitting FBI-adjacent systems before. The group previously said it accessed several FBI systems and framed the activity as payback, a claim covered in prior reporting on this site, and it also told reporters it held 2 to 3 terabytes of FBI-linked data in an earlier round of claims, a figure documented at the time. The FBI subsequently confirmed it was investigating a breach claim from the group, an update covered in a separate article. Whether the current portal outage is a continuation of that same incident, a follow-on intrusion, or a fresh claim dressed up with old numbers is one of the central unresolved questions in this story.
That repetition is itself a data point. Groups that keep returning to the same software category are usually doing so because it keeps working. Enterprise resource planning and HR platforms like PeopleSoft sit deep inside organizations, often running on older infrastructure with long patch cycles, and they hold exactly the kind of personal data that fuels follow-on identity fraud and extortion leverage.
ShinyHunters’ leak site returns with new targets
The FBI claim did not stay the group’s only activity for long. ShinyHunters’ own leak site, where it typically lists victims and posts samples of stolen data, went offline for a stretch before coming back online on October 1, 2026, according to a report from lodi411. When the site returned, it listed O’Reilly Automotive and Dexcom among its new targets, neither of which has any apparent connection to the FBI claim.
ShinyHunters attributed the outage to its own infrastructure upgrades and to attacks from rival hacking groups, explicitly denying that a law enforcement takedown was responsible. As with every other claim in this story, that explanation comes from the group itself and has not been independently verified. What it does show is that ShinyHunters treated the FBI claim as one campaign among several rather than its sole focus, continuing to add unrelated victims to its leak site while the FBI investigation was still open.
Timeline of the FBI job portal incident
| Date (2026) | Event | Source |
|---|---|---|
| May-June | Mandiant reports CVE-2026-35273, a PeopleSoft zero-day, actively exploited against academic institutions | Help Net Security |
| Sept. 21 (night) | ShinyHunters claims initial access via alleged PeopleSoft zero-day, says it moved laterally afterward | BleepingComputer |
| Sept. 22 | Applicant and Special Agent portals go offline; defacement banner reportedly appears; ShinyHunters claim breaks publicly | The Register, The Hacker News |
| Sept. 23 | Jobs site still offline while FBI investigates | PBS, Cybersecurity Dive |
| Sept. 25 | FBI confirms it is aware of the claims and is investigating with third-party providers; entry point still undetermined | The Register |
| Sept. 28 | Both applicant portals remain offline, one week after the claimed intrusion | Help Net Security |
| Oct. 1 | ShinyHunters’ leak site returns online after a brief outage, lists O’Reilly Automotive and Dexcom as new targets; group says the outage was due to its own upgrades and rival attacks, not an FBI takedown | lodi411 |
| Oct. 4 | Both applicant portals remain offline, roughly two weeks after the claimed intrusion | Subsequent reporting |
| Oct. 7 | FBI says internal review found a contractor’s security failure caused the breach; cyber chief Brett Leatherman says the contractor failed to apply a required patch on a third-party-managed platform; bureau removes the contractor, later reported tied to Accenture | FBI statement, Reuters |
| Oct. 9 | FBI arrests Edward Dubrovsky in Pennsylvania in connection with the hack | Multiple outlets |
How this compares to other 2026 federal and enterprise breaches
The FBI portal claim doesn’t exist in isolation. 2026 has been a heavy year for both PeopleSoft-linked incidents and federal-agency breach disclosures, and stacking this incident against recent comparable cases helps calibrate how unusual (or not) it actually is.
| Incident | Alleged vector | Claimed scope | Status as of Oct 9, 2026 |
|---|---|---|---|
| FBI job portals (this story) | PeopleSoft zero-day claim; contractor missed required patch | 2-3TB, applicant/employee PII | Contractor removed; suspect arrested |
| WSO2 API flaw | CVSS 10 API vulnerability | Exploited 12 days before KEV listing | Patched, added to CISA KEV |
| Citrix NetScaler zero-days | Multiple CVEs | Thousands of exposed instances | CISA gave 3-day remediation deadline |
| SharePoint CVE-2026-65660 | Remote code execution flaw | Organization-dependent | Hit CISA remediation deadline |
| Earlier ShinyHunters/PeopleSoft campaign | Oracle zero-day | 100+ organizations affected | Disclosed, patched by Oracle |
Two patterns stand out. First, CISA’s Known Exploited Vulnerabilities catalog has become the de facto clock for federal remediation this year, with agencies like WSO2 and Citrix users given days, not weeks, to patch once a flaw lands on the KEV list. This FBI incident notably lacks that clock entirely, because no CVE has been confirmed for whatever vulnerability ShinyHunters actually used. Second, ShinyHunters keeps showing up as a common denominator across PeopleSoft-adjacent incidents in 2026, which is unusual persistence against a single software family compared to how most extortion groups spread across varied targets.
Why PeopleSoft keeps showing up in breach headlines
Oracle’s PeopleSoft has been running enterprise HR, payroll, and campus administration workloads since the 1990s, and much of that footprint is inside government and higher-education environments that upgrade on multi-year cycles. That combination, old codebase, high-value personal data, and slow patch adoption, makes PeopleSoft a recurring target rather than a one-off.
The May-June 2026 exploitation of CVE-2026-35273 against academic institutions, documented by Mandiant and reported by Help Net Security, established that at least one PeopleSoft zero-day was actively weaponized this year before a patch existed. Whether the current FBI claim reuses that same flaw or represents a second, undisclosed vulnerability is the single most consequential open technical question in this story, because it determines whether every other PeopleSoft-reliant organization needs to treat this as an active, unpatched threat right now.
Market and industry impact
Federal breach claims tend to move slower through markets than consumer-facing incidents, but they carry outsized weight in the government IT and cybersecurity vendor space. Oracle has faced a string of PeopleSoft-linked disclosures in 2026, and each new claim, confirmed or not, adds pressure on the company’s enterprise applications division to accelerate patch cadence and improve zero-day detection for a product line that predates modern DevSecOps practices by two decades.
For federal agencies specifically, this incident lands during a period of heightened scrutiny of legacy enterprise software running mission-critical HR and identity workflows. Security vendors selling attack-surface monitoring, identity threat detection, and third-party risk management tools into the federal space are likely to point to this incident as validation for procurement conversations already underway following the WSO2, Citrix, and SharePoint disclosures covered above. Organizations running PeopleSoft in any capacity, not just federal agencies, should treat the unconfirmed zero-day claim as a prompt to review vendor patch status and monitor CISA’s KEV catalog for a forthcoming entry, rather than waiting for full confirmation.
What outside voices are saying
Coverage of the incident has been consistent on one point: confirmation is thin and the site is still down. Help Net Security summarized the state of play plainly, noting that “The FBI’s online portals for job applicants and special agent applicants are still unavailable, following what appears to be successful compromises by the ShinyHunters cyber extortion group,” in its September 28 report.
The Register, which has spoken directly with the group, reported that “On Tuesday, the criminals told us that they broke into the bureau via yet another Oracle PeopleSoft zero-day flaw in the FBIJobs.gov portal, which remains down as of Friday,” in its September 25 story.
The FBI’s own statement, as relayed to reporters, was measured: “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” according to CBS News.
Politico’s coverage underscored just how unresolved the technical details remain, reporting that “A representative for the group claimed to 404 Media that they hacked into PeopleSoft using a previously unknown software vulnerability, or zero-day, though the first person with knowledge of the breach said investigators had not yet determined if that was the case,” in its September 22 report.
By the end of the week, the basic fact set hadn’t moved much. As Hungarian outlet LAVX put it in its own roundup, “The site remained offline Friday,” in its report on the incident.
Risk to applicants and current employees
Even without confirmation of the full scope, the categories of data ShinyHunters claims to have taken create real risk regardless of whether every detail checks out. Names, home addresses, and phone numbers of federal agents and their families, if genuinely exposed, sit well outside typical breach-notification templates built around credit card numbers or email addresses. That kind of data supports physical targeting, not just financial fraud, which is why security teams tracking this incident are watching for any FBI guidance to current employees and applicants separately from the standard identity-theft-monitoring playbook.
Anyone who applied through FBIJobs.gov in recent months, or who currently works for the bureau, should treat this as an active, unresolved situation. Until the FBI confirms scope, the safest posture is watching official bureau channels for guidance rather than acting on unverified figures from the group claiming responsibility. Organizations dealing with similar uncertainty after a breach claim often turn to structured monitoring rather than reactive scrambling, an approach outlined in our dark web monitoring setup guide.
Predictions: where this story goes next
- A CVE gets assigned within weeks, not days. Given the pattern with WSO2 and Citrix this year, expect Oracle and CISA to formalize a CVE identifier for whatever flaw is confirmed, likely followed by a KEV catalog entry once active exploitation is verified beyond ShinyHunters’ own claims.
- The FBI will disclose a narrower scope than ShinyHunters claims. Extortion groups routinely inflate figures for leverage; expect the bureau’s eventual confirmed numbers, if any are released publicly, to cover a smaller subset of the alleged 2-3TB.
- Portal restoration is taking longer than a typical outage. That has already played out: federal systems handling PII generally require forensic clearance before returning to production, and both apply.fbijobs.gov and the Special Agent portal remained offline as of October 4, 2026, roughly two weeks after the claimed intrusion, with no public restoration date given even after the FBI’s October 7 contractor finding.
- Other PeopleSoft-reliant federal and academic institutions will face increased scrutiny. Given Mandiant’s confirmed CVE-2026-35273 exploitation earlier this year, expect renewed advisories urging PeopleSoft operators to audit patch status regardless of whether the FBI’s specific vector is ever confirmed.
- ShinyHunters will likely keep resurfacing with new claims. That pattern already continued: after a brief outage, the group’s leak site returned on October 1, 2026, with O’Reilly Automotive and Dexcom listed as new targets. The group’s trajectory this year, first against 100+ PeopleSoft users, then a WAF bypass, then FBI systems, then this portal claim, then new unrelated targets, points to continued activity against the same software family rather than a one-time event.
- Expect more named defendants, not fewer. That shift from investigation to prosecution already started: the FBI arrested Edward Dubrovsky in Pennsylvania on October 8, 2026 in connection with the hack. Federal cybercrime cases tied to extortion groups like ShinyHunters typically widen to additional defendants as investigators build out the case, so this arrest is unlikely to be the last.
What organizations running PeopleSoft should do now
Security teams don’t need to wait for a CVE to start reducing exposure. Confirming current PeopleSoft patch levels against Oracle’s latest critical patch update, reviewing which internet-facing PeopleSoft instances exist across the environment, and tightening web application firewall rules around known PeopleSoft attack patterns are all steps that don’t depend on official confirmation of this specific incident. Given ShinyHunters’ history of bypassing WAF protections on a related PeopleSoft bug, as reported previously, WAF rules alone should not be treated as a complete mitigation.
Third-party risk reviews matter here too, and this incident shows why. The FBI’s October 7, 2026 finding, that a contractor’s security failure caused the breach, confirms the risk this section originally flagged. As FBI cyber chief Brett Leatherman explained, the problem wasn’t a missing patch but an unapplied one, a distinction that matters for any organization taking a vendor’s word that a system is current. Organizations that outsource HR or recruitment portal hosting, a common setup, should confirm their vendors’ patch cadence and incident response commitments rather than assuming internal PeopleSoft hardening covers the full risk surface. Removing the contractor, later reported to be tied to Accenture, as the FBI said it did, is a reasonable first step, but it’s a response to one incident rather than a substitute for an ongoing vendor risk review.
Frequently asked questions
Is the FBI jobs website currently down?
Yes. Both apply.fbijobs.gov and the Special Agent Applicant Portal remained unavailable as of October 4, 2026, and no restoration date had surfaced publicly even after the FBI’s October 7 statement on what caused the breach.
Who is ShinyHunters?
ShinyHunters is a cyber extortion group that has claimed responsibility for numerous breaches in 2025 and 2026, including multiple incidents tied to Oracle PeopleSoft software and a prior claim involving FBI systems.
Has the FBI confirmed the breach?
The FBI confirmed it was aware of the claims and investigated them. On October 7, 2026, the bureau said an internal review found that a security failure by one of its contractors caused the breach, and that it had removed the contractor. The FBI still hasn’t confirmed the scope of any data exposure, according to statements reported by The Register and CBS News.
What did the FBI say caused the breach?
On October 7, 2026, the FBI said its internal review traced the breach to a security failure by one of its contractors, not its own enterprise network. FBI cyber chief Brett Leatherman later specified that the contractor “failed to implement a security patch explicitly issued to secure the platform.” The bureau removed the contractor, later reported to be tied to Accenture, and took steps to limit further risk, though it still hasn’t said whether the missed patch relates to the same PeopleSoft zero-day ShinyHunters described.
Was the contractor tied to Accenture?
The FBI did not name the contractor directly, but multiple outlets, including Reuters, reported that the contractor removed after the breach worked for Accenture and was responsible for the affected platform.
What is the PeopleSoft zero-day ShinyHunters claims to have used?
ShinyHunters says it used a previously unknown Oracle PeopleSoft vulnerability enabling remote code execution. No CVE identifier has been confirmed for this specific claim as of publication, and it is unclear whether it is the same flaw (CVE-2026-35273) that Mandiant reported being exploited against academic institutions earlier in 2026.
How much data does ShinyHunters claim to have stolen?
The group claims 2 to 3 terabytes of data covering current and former FBI employees and job applicants, including names, addresses, and phone numbers. This figure has not been independently verified by the FBI.
Did ShinyHunters’ leak site go offline too?
Briefly. The site returned on October 1, 2026, listing O’Reilly Automotive and Dexcom as new targets. ShinyHunters said the outage was caused by its own infrastructure upgrades and attacks from rival hacking groups, not a law enforcement takedown, though that explanation hasn’t been independently verified either.
Has anyone been arrested in connection with the FBI hack?
Yes. The FBI arrested Edward Dubrovsky in Pennsylvania on October 8, 2026 in connection with the ShinyHunters hack. Federal authorities had not released detailed charging documents as of this writing.
Is this the same incident as the FBI’s earlier “cyber incident” disclosure this month?
It is not clear from public reporting whether this portal outage is the same event as an earlier FBI cyber incident disclosure or a related but separate claim from the same group.
Should current FBI job applicants be worried?
Applicants and current employees should watch official FBI channels for guidance rather than react to unverified figures from the group claiming responsibility, since the bureau has not confirmed the scope of any exposure.
Is this vulnerability on CISA’s Known Exploited Vulnerabilities catalog?
No. As of this article’s publication, no CVE tied specifically to this claimed FBI intrusion has been added to CISA’s KEV catalog.
Related Coverage
- FBI Confirms Breach: ShinyHunters Claims 2TB Stolen [2026]
- FBI Declares 'Cyber Incident,' 5,000 Agents Notified [2026]
- OpenAI Rogue Agents Hit US Sites, Alert Spans Dozens [2026]
- ShinyHunters Bypass WAF on CVSS 9.8 PeopleSoft Bug [2026]
- Nearly Half of UK Firms Breached: 43% Hit, Says 2026 Survey
