Product1 publisher3 min readPublished
ShinyHunters claims an Oracle PeopleSoft exploit opened the FBI's job application portal
The group told 404 Media it reached apply.fbijobs.gov through Oracle's PeopleSoft, and the FBI says the point of breach is still undetermined. Three of the bureau's recruiting pages have been serving error screens.
The Product Desk · Product desk
What happened
- ShinyHunters claims to hold personal data on "all" FBI employees and job applicants, according to a report published Tuesday by 404 Media.
- The group reportedly got into the FBI's recruitment site through an exploit in Oracle's PeopleSoft product, and says the haul covers applicants as well as current staff.
- A ShinyHunters representative wrote to The New York Times that the group is not extorting the FBI and wants only to correct a public service announcement the bureau issued about it.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- contradiction 404 Media attributes the entry to a PeopleSoft exploit while the FBI says the point of breach is undetermined, so operators reading both statements get opposite instructions about whether their own vendor stack is implicated.
- constraint Without a vulnerability identifier or affected version, a team running the same HR software cannot patch to this incident; all that is left to check is reachability, account scope and retention.
- exposure Rejected applicants are in the file with no way to act: the product has no reason to email them, and they cannot ask anyone to rotate a credential on their behalf.
- decision The bureau's statement puts third-party providers in scope. Any organisation on a hosted recruiting portal has to test whether its contract actually produces a straight answer about the vector.
An applicant who filed for a special agent job and went to check on it this week found a maintenance page at apply.fbijobs.gov reading, "We're sniffing out site updates for you!" [4] The FBI Jobs home page returns a 503 Service Temporarily Unavailable error [5]. The eligibility page still loads, under a banner saying "Apply.fbijobs.gov and the Special Agent Application Portal are currently unavailable" [6]. By Wednesday afternoon that was three recruiting surfaces in some state of down [18].
For a team that runs the same HR software, the part that matters most is how the group got in. 404 Media reported that ShinyHunters reached the recruitment site through an exploit in Oracle's PeopleSoft [2]. The bureau does not go that far. "While the point of breach is still undetermined - whether a third-party or the FBI's enterprise - we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk," a spokesperson told CNET [7].
No vulnerability identifier or affected version appears in the reporting [19]. So Monday's task is working out which of your candidate-facing portals answer from the open internet, which accounts can read a complete applicant record, and whether your vendor will tell you what version you are running when you ask.
ShinyHunters normally demands extortion payments to keep stolen data unpublished, and has been linked to a breach of 4.4 million TransUnion credit records and to access to servers belonging to Rockstar Games [14][13]. A breach by the group disrupted software used by 9,000 schools during final exams in May [3]. This time a representative wrote to The New York Times: "We reiterate we are not extorting the FBI and this is not financially motivated... Our intention, goal and motive is to solely set the record straight." [9] What the group says it wants is a correction to a public service announcement the FBI issued about it [8]. CNET said the group couldn't be reached for comment [17].
A security analyst who spoke to CNET anonymously to avoid retaliation said of the group's statements, "Never trust anything they say. Ever." [11] The same analyst said the data could destroy FBI employees' ability to go undercover, travel to other countries and more [12]. Joseph Cox, who broke the story at 404 Media, wrote via email: "This data presents significant national security and counterintelligence risks, and isn't in the hands of a foreign intelligence agency, but a group of likely younger, English-speaking hackers." [10]
Your own HR records sort on two axes: whether the person is still a user of the product, and whether their file sits behind a public URL. Current employees fall in the first column. You can reach them and force a password change. An applicant you turned down falls in the second, out of reach of anything the product can send. Retention for rejected applicants is the setting that decides how many of those people are in the dump.
The bureau has had a run of this. It has seen suspicious activities this year on the system it uses to manage wiretapping and surveillance, and an Iran-backed group claimed it breached the personal email of FBI Director Kash Patel [16].
What to watch
- Whether Oracle or the FBI ties the intrusion to a specific PeopleSoft vulnerability and version. That would turn this into a patch job for everyone else.
- Whether the bureau's investigation lands on a third-party provider or its own enterprise, as its spokesperson said is still undetermined.
- Whether the data appears publicly despite the group's statement that it is not extorting the FBI.