Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
BREACH WATCH BRIEF High ☁️ Breach

ShinyHunters Breach Exposes 2‑3 TB of FBI Employee Data via Unpatched Oracle PeopleSoft on Third‑Party Platform

ShinyHunters exploited an Oracle PeopleSoft zero‑day on a vendor‑managed platform, moving into FBI AWS GovCloud and stealing 2–3 TB of employee data. The breach highlights the need for continuous third‑party risk monitoring and verifiable patch‑management evidence for audit readiness.

ADTP Breach Watch · October 9, 2026 · BleepingComputer
SeverityHigh
Type☁️ Breach
ConfidenceHigh
ReportedOct 9, 2026
Government & Public Sector Federal agencies Contractors handling government data Vulnerability Exploit Data Exfiltration
Check if you use it. This incident came through a third party or the supply chain. If the product or supplier is in your estate or your vendors', start with the questions to ask below.

What happened

The FBI confirmed that members of the ShinyHunters extortion group accessed FBI systems by exploiting an alleged Oracle PeopleSoft zero‑day vulnerability on a platform run by a third‑party vendor. After initial access, the actors pivoted into the agency’s AWS GovCloud environment and exfiltrated between 2 TB and 3 TB of data, including personal, medical, and employment records of current and former FBI personnel.

Why it matters for trust and compliance

  • This incident demonstrates how a lapse in a vendor’s patch‑management process can break a control‑objective for third‑party oversight, making continuous monitoring and documented evidence of vendor security practices essential for audit readiness.
  • Continuous monitoring of vendor patch cycles provides the evidence needed to prove due diligence during audits.
  • Documented vendor security attestations create a defensible trail that aligns with multiple frameworks’ supply‑chain risk controls.

Who is affected

Federal agencies Contractors handling government data

Recommended actions

  1. Create an up‑to‑date inventory of all third‑party platforms that host or process sensitive data.
  2. Require vendors to supply recent patch‑management records for known critical vulnerabilities.
  3. Implement continuous third‑party risk monitoring that alerts on missed security updates.
  4. Retain logs of vendor communications and remediation actions for audit evidence.

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.