ShinyHunters claims FBI hack: 'This is NOT financially motivated'

ShinyHunters claims it hacked the FBI and stole more than 2 TB of employee data - and this time it’s personal.

The gang wants the Feds to correct the record on how it operates.

“This is NOT financially motivated,” a Shiny spokesperson told The Register.

“We want the FBI to correct or retract their statements they made, which included substantial false allegations.” The FBI did not immediately respond to The Register’s request for comment.

According to a ShinyHunters spokesperson, the extortion group exploited an Oracle PeopleSoft zero-day vulnerability on the FBI jobs webpage, which it says allowed remote code execution (RCE) on the servers.

The group then defaced the website, replacing it with a “This site has been seized by ShinyHunters” banner and image shared with The Register.

At press time, the site says it is “currently down for maintenance but will be back up soon!” ShinyHunters also claims it moved laterally from the compromised site onto the FBI’s managed servers on AWS GovCloud, and downloaded about 2 TB to 3 TB of data belonging to current, former, and prospective FBI employees.

“We hold data on all FBI employees and applicants,” the spokesperson told us.

ShinyHunters claims the compromised FBI services include human resources, MedLink, and Criminal Justice Information Services.

Neither Oracle nor AWS immediately responded to our inquiries, including whether Oracle is aware of a PeopleSoft preauth RCE zero-day, and whether AWS has any insight into the alleged data theft.

We will update this story if we receive any response.

Unlike most of the group’s smash-and-grab operations that involve a multimillion-dollar ransom demand to not leak the stolen files, ShinyHunters said it isn't seeking an extortion payment from the FBI.

Instead, it wants the federal cops to retract statements made about ShinyHunters in a May 15 bulletin, shortly after the gang broke into ed-tech giant Instructure's Canvas platform and claimed to have stolen data tied to hundreds of millions of students, teachers, and staff.

The FBI said ShinyHunters uses “harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting.” The security alert also said that extortionists “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.” Shiny claims none of this is true.