PeopleSoft is not new software. Oracle has owned it since 2005, and plenty of the organisations still running it - universities, government agencies, large employers with decades of HR history to migrate - keep it precisely because ripping out a system of record that deep is its own multi-year project. That's the backdrop to what ShinyHunters told BleepingComputer this week: "We found another one yesterday and immediately exploited it on the FBI." No patch existed when they used it. None was public at time of writing. The group says it moved from the initial PeopleSoft foothold into the FBI's AWS GovCloud infrastructure, reaching what it describes as Criminal Justice, HR and Medlink services along the way.
The bureau's statement leaves the actual question open
The FBI's response, also relayed by BleepingComputer, was narrow: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." That confirms awareness of a claim, not the claim itself - it neither denies an intrusion happened nor confirms what, if anything, left the network. ShinyHunters' own account puts the haul at 2-3TB, covering current and former employees, job applicants, and material it associates with the bureau's Medlink health service - which, if accurate, would put protected health information for FBI personnel in among whatever else was taken. Until the FBI's own investigation lands on a number, the size and sensitivity of this breach exists only as one extortion group's word.
This isn't ShinyHunters' first run at PeopleSoft this year
In June, Oracle shipped an out-of-band fix for CVE-2026-35273, a separate unauthenticated remote-code-execution flaw in PeopleSoft PeopleTools 8.61 and 8.62, after ShinyHunters had already used it to compromise roughly 300 PeopleSoft instances and claim data from more than 100 organisations, according to SecurityWeek's reporting at the time. CISA added that CVE to its Known Exploited Vulnerabilities catalog two days after the patch shipped. One confirmed victim from that round, the University of Nottingham, had 454,600 current and former students' personal and academic records published on the group's leak site, per Arctic Wolf's account of the campaign. The flaw used against the FBI this week is a different, still-unpatched bug in the same product line - not a reuse of the June issue, but a second discovery in software the group has clearly kept digging into since its first pass paid off.
A grudge, by the group's own account
ShinyHunters has framed the FBI intrusion as retaliation for a FLASH report the bureau published in May detailing the group's activities - the kind of motive that, true or not, tells you something about how this particular group operates: it treats law enforcement attention as provocation rather than deterrent, and says so openly. The group also claims to have used this same new PeopleSoft flaw against unspecified Fortune 500 companies, which - if it holds up - makes the FBI disclosure less a standalone incident and more the highest-profile entry on a target list that already extends well beyond one government agency.
- If you run PeopleSoft in any configuration, don't treat June's CVE-2026-35273 patch as closing the book on this product line - the same actor has now found a second, separately exploitable flaw in it within three months.
- Segment PeopleSoft and other legacy ERP/HR platforms from cloud infrastructure they don't strictly need to reach; the FBI's alleged path from a PeopleSoft foothold into AWS GovCloud services is exactly the lateral-movement risk that segmentation exists to blunt.
- Extortion groups exploiting the same product family repeatedly are worth tracking as a pattern, not just a one-off CVE - budget for an emergency PeopleSoft patch cycle the way you would for any internet-facing system with a live history of zero-day use.
- Treat claims of stolen health or personnel data as requiring the same urgency as a confirmed breach until your own investigation says otherwise - waiting for the extortion group's proof, rather than acting on the claim, has been the costlier choice in nearly every comparable case this year.
A system old enough to predate most of its own users' careers doesn't stop being a target because it's familiar - if anything, the opposite. If you're running PeopleSoft or a comparable legacy platform and want a second opinion on how exposed it is to exactly this pattern, email sales@halfteck.com.