FBI Hack Claim: Is Your NC Hiring Portal an Open Door?

Updated October 7, 2026: the FBI has given a first account of the cause, and the June PeopleSoft flaw is under attack again. On October 6 the FBI said its review to date traces the breach to a contractor's failure to apply a security patch on a platform run by a third party. On September 25 Mandiant reported a new wave of attacks on the June flaw that gets past some web application firewall rules. Both are covered below, and the checklist now follows Mandiant's September guidance. This post first ran on September 23.

In short: On September 22, 2026 it became public that the ShinyHunters extortion group had defaced the FBI's jobs site. The group claimed it stole 2 to 3 terabytes of employee and applicant data through a zero-day flaw in Oracle PeopleSoft. On October 6 the FBI said its review so far traces the breach to "a security failure of a platform managed by a third-party organization," after "a contractor failed to implement a security patch explicitly issued to secure the platform," NBC News reported. The FBI removed the contractor and has not named it or the platform. The pattern behind the claim is confirmed too: in May and June the same group exploited a PeopleSoft flaw in a campaign that led Mandiant to warn more than 100 organizations with exposed systems, that flaw is on CISA's exploited list, and in September Mandiant reported a new wave of attacks on it. If your company runs any hiring, HR or payroll system that faces the internet, this is your week to find out who patches it, including any part a vendor or contractor runs for you.

You may not run PeopleSoft. Many North Carolina manufacturers and distributors do run something in the same position: a careers page that feeds an applicant system, a payroll or benefits portal, an ERP web screen for remote staff. These systems face the internet on purpose. And they hold the most sensitive records a small company keeps: Social Security numbers, dates of birth, home addresses, sometimes spouses and dependents.

Key takeaway: The FBI's review so far traces its breach to a security patch that was issued and not applied. Hiring and HR systems face the internet by design, hold your most sensitive employee data, and may be patched by a vendor rather than by you. Mandiant reported this group's attacks on PeopleSoft in June and a renewed wave on September 25, and the group says the FBI was another target.

Want someone to find every HR, payroll and ERP system you have facing the internet, and who patches each one? Preferred Data Corporation has done this work for Piedmont Triad companies out of High Point since 1987. Call (336) 886-3282 or contact us.

What happened at the FBI, and what is actually confirmed?

As of October 7, 2026, the FBI has given a first account of the cause: its review to date points to a platform run by a third-party organization, where a contractor failed to apply a security patch issued to secure it. The FBI removed the contractor and has not named it. Journalists have found part of a sample of records the group provided to be accurate. The rest, including the zero-day, the cloud pivot and the data volume, still comes from the attackers.

Here is where each piece stands, source by source:

Claim	Who says so	Status as of Oct 7
FBIjobs.gov was defaced with a "seized by ShinyHunters" banner	The Register, CyberScoop	Widely reported. The FBI's first statement refers to "unauthorized activity affecting FBIjobs.gov"
The FBI is investigating	FBI statements quoted by Nextgov/FCW, Cybersecurity Dive and NBC News	Confirmed. On October 6 the FBI described "this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters"
A contractor's missed security patch, on a platform run by a third party, caused the breach	FBI statement of October 6, per NBC News	Confirmed by the FBI's review so far. The FBI removed the contractor and has not named it or the platform
Names, home addresses and phone numbers of agents and spouses were taken	Sample given to 404 Media, per TechCrunch	Not confirmed by the FBI. 404 Media checked a portion of the sample against public records
Entry was through Oracle PeopleSoft	The attackers, per BleepingComputer. The FBI's own privacy impact assessment lists Oracle PeopleSoft HRS 9.2 as portal software	Reported, not confirmed by the FBI
The flaw was a zero-day, with no fix available	The attackers, per BleepingComputer and The Hacker News	Not supported by the FBI's account, which says a patch had been issued for the platform and was not applied
They moved into FBI servers in AWS GovCloud and took 2 to 3 TB	The attackers, per CyberInsider	Unverified
Motive is retaliation for the FBI's May 15 warning about the group	The attackers' own statement	Their stated reason. They demanded the warning be withdrawn within a week

The FBI first said it "is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." On September 23 it went further, telling Cybersecurity Dive that "the point of breach is still undetermined," whether at a third party or inside the FBI, and that it is working with "those third-party providers that support FBIJobs.gov." On October 6 it gave a first answer. Brett Leatherman, assistant director of the FBI's Cyber Division, said the review so far found "a security failure of a platform managed by a third-party organization," after "a contractor failed to implement a security patch explicitly issued to secure the platform," NBC News reported. The FBI says it removed the contractor, which it did not identify. It also said it will "continue to bring the responsible parties to justice, with multiple arrests already occurring." At least one outlet has attributed the zero-day and GovCloud details to an FBI spokesperson. That does not match any FBI statement we have found, so we still treat those details as the attackers' claims.

Why would a hacking group go after a hiring portal?

Because an applicant portal has to accept connections from strangers, and it stores exactly what extortion crews sell. Its whole job is to let people you have never met upload personal details. That makes it one of the few internal systems a company deliberately puts on the open internet.

The June campaign shows the pattern is not new. Google's Mandiant team reported on June 11, 2026 that ShinyHunters exploited a PeopleSoft flaw as a zero-day from May 27 to June 9. Mandiant notified more than 100 organizations whose exposed systems matched, 68 percent of them in higher education and most in the United States. Data taken in that campaign was posted to the group's leak site on June 9.

The campaign did not stop in June. On September 25 Mandiant reported a new wave of attacks on the same flaw, with web shells planted on dozens of systems in sectors including government, healthcare, transportation and IT services.

The group's claim about the FBI names the same doorway. A screenshot the group shared with CyberInsider appears to show a /PSEMHUB/ page on the FBI applications site. That is the same PeopleSoft component, Environment Management Hub, that the June flaw lived in.

Is this the same PeopleSoft flaw Oracle fixed in June?

Not confirmed. The FBI says the breach followed a contractor's failure to apply a patch that had been issued for the platform. That points away from a zero-day, a flaw with no fix, but it does not say whether the flaw was the June one or a different one that already had a fix. The FBI has not named the platform or the patch. The FBI's 2022 privacy impact assessment for the jobs portal lists Oracle PeopleSoft HRS 9.2 among the software it runs on. In late September the group told The Hacker News that it used a PeopleSoft zero-day different from the June flaw. For a business owner the action is the same either way: find the system, patch it, and take the management piece off the internet.

The June flaw is CVE-2026-35273. It scores 9.8 out of 10: an outsider can reach the /PSEMHUB/hub endpoint without logging in, and that can lead to running code on the server. It affects PeopleSoft PeopleTools 8.61 and 8.62. Oracle issued an emergency Security Alert on June 10. Rapid7 reports that it came with an out-of-band patch, while early coverage said only mitigations were available, and CISA added it to the Known Exploited Vulnerabilities catalog on June 12. At the time, Oracle called its recommended mitigations "a high-priority risk reduction measure," SecurityWeek reported.

The FBI has not said which patch was missed in its own case. Its account so far still makes this a lesson in patch ownership: a fix had been issued for the platform, and a contractor did not apply it. Unapplied patches are also what the September wave of attacks on the June flaw went after: Mandiant says it targeted "organizations that implemented WAF rules but did not patch the vulnerability." Exposure is the other lesson: a management component that no outsider needs should not answer outsiders at all. Mandiant's September guidance puts the patch first, then disabling the Environment Management Hub. It also shows why a web application firewall rule is no substitute for the patch: in the September wave, attackers got past rules blocking /PSEMHUB/ by encoding one letter of the path, sending /%50SEMHUB/ instead.

We do not run PeopleSoft. Does this still apply?

Skip the patch. Keep the inventory question. Plenty of companies without PeopleSoft still have hiring, HR, payroll or ERP systems that someone opened to the internet, sometimes years ago, without anyone clearly owning the patching.

Send your IT provider three questions in writing, with a reply-by date:

Which of our systems that hold employee or applicant data can be reached from the internet, and who hosts each one?
For each one, who applies security updates, and when was the last one applied?
Do any of them run Oracle PeopleSoft, and if so, is Oracle's June 10 Security Alert guidance applied and is the management hub blocked from outside?

You do not need to follow the technical detail to grade the answers. A good answer names things. A brush-off does not.

What you asked	An answer that means something	An answer that means nothing
What faces the internet	Names each system, whether it is hosted by a vendor or by you, and how staff reach it	"It is all in the cloud"
Who patches it	A name or a vendor for each system, plus a date	"We keep everything up to date"
PeopleSoft	"None here," or a version, a patch date and a firewall rule	"We would have to check"

A "we would have to check" is not proof anything is wrong. Usually it means nobody has asked in years. For a system that holds Social Security numbers, it is still worth fixing this month.

If you would rather hand those three questions to someone who knows what a good answer looks like, Preferred Data Corporation's cybersecurity team is in High Point at (336) 886-3282.

What should a PeopleSoft shop check this week?

Patch, then block, then look for signs someone was already inside. A patch closes the door. It does not tell you whether someone already came through it.

We covered the June flaw in detail when it broke, in our Oracle PeopleSoft CVE-2026-35273 defense guide. Hand that guide, Mandiant's June hunting guidance and its September update to your IT team. The short version:

[ ] Confirm the patch from Oracle's June 10, 2026 Security Alert is applied. Mandiant says "WAF rules and path-based blocking are not a substitute for patching." On a PeopleTools release older than 8.61, Oracle says earlier versions are likely affected too and recommends upgrading to a supported version
[ ] Disable the Environment Management Hub service if it is not used for patching. Mandiant says to disable it in multi-server configurations and to remove the PSEMHUB application entirely in single-server configurations. If your team does use the hub for patching, keep it off the public internet instead: Mandiant says restricting it from public internet access "is non-breaking for standard PeopleSoft Internet Architecture (PIA) user sessions." If you block /PSEMHUB/* and /PSIGW/HttpListeningConnector at a web application firewall or proxy, Mandiant says to "enforce blocking on the normalized path," so percent-encoded and mixed-case variants such as /%50SEMHUB/ are caught too
[ ] Hunt for signs of both campaigns on those servers since late May, using Mandiant's indicators, including web server log entries for /PSEMHUB/ and any percent-encoded variant

What has changed since September 22: the FBI's review so far traces its breach to a patch that was issued and not applied, and Mandiant says attackers are getting past web application firewall rules that match the path as plain text. A patch only protects you once someone applies it, so ask whoever runs the system for the date the last one went on. If Oracle or the FBI names the flaw used against the FBI, we will update this post.

What happens to your employees' families if HR data leaks?

This group does not stop at the company. The FBI's May 15 warning, public service announcement I-051526-PSA, says ShinyHunters actors send "threatening text messages and phone calls to victims and their family members, and in some cases, swatting." That warning is the one the group demanded be withdrawn.

For a small employer, that changes what a breach means. Stolen HR records give an extortion crew a home address and a spouse's phone number, not just an email login. If your HR or applicant data is ever exposed, brief your people before the calls start. Use the FBI's own advice:

Verify any urgent or unusual request through a different channel before acting on it
Do not pay and do not engage with the demand
Report it to IC3, 1-800-CALL-FBI, or the FBI Charlotte field office, which covers North Carolina. Save every phone number, username, message and screenshot

There is also a legal clock. North Carolina's breach statute, G.S. 75-65, puts the duty to notify on the business that owns or licenses the personal information. That is you, even when the system belongs to a vendor. If the incident meets the statute's definition of a breach in G.S. 75-61, notice goes to affected North Carolina residents "without unreasonable delay" and to the Attorney General's Consumer Protection Division. If more than 1,000 people are notified at once, the nationwide consumer reporting agencies must be notified too.

How much applicant data should we be keeping at all?

Keep only what you are required to keep. Records you have deleted cannot be stolen. Federal rules under 29 CFR 1602.14 generally require employers to keep applications and hiring records for one year from the date the record was made or the hiring decision, whichever is later. Larger federal contractors must keep them for two years under 41 CFR 60-1.12, and anything tied to a pending charge or lawsuit must be kept until it is resolved. Many applicant systems keep everything forever unless someone changes the setting.

Ask your HR lead and your counsel how long you actually need to keep applicant files, including any litigation holds. Then ask your IT provider whether the system is set to purge on that schedule. Also ask whether you collect Social Security numbers at the application stage at all, or only after an offer.

Key takeaway: The cheapest breach to clean up is the one where the old records were already gone.

What should we do this week?

Four steps, in order. On the FBI's account so far, its breach came down to what step two covers: a patch that was issued and not applied.

Inventory. List every system holding employee or applicant data that can be reached from the internet, and who hosts it.
Assign patching. Put one owner and a last-patched date against each one. Send the three questions above if you cannot fill that in.
Close what outsiders do not need. Admin panels and management hubs should never answer the public internet. Network segmentation and firewall rules do this cheaply.
Shrink and prepare. Set a retention schedule for applicant data, and write a one-page note telling staff what to do if an extortion call reaches their home.

Our managed IT team can walk you through steps one through three. Call (336) 886-3282.

Frequently Asked Questions

Did ShinyHunters really hack the FBI?

The FBI now links the group to it. Its October 6 statement refers to "this cyber incident involving FBIjobs.gov and the cyber-criminal group ShinyHunters," and says its review to date traces the breach to a security failure on a platform run by a third party, after a contractor failed to apply a security patch. The jobs site was defaced and 404 Media found part of a sample the group provided to be accurate. As of October 7, 2026, the zero-day, the cloud pivot and the 2 to 3 TB figure are still the attackers' claims.

Is there a patch for the flaw used against the FBI?

The FBI has not said which flaw was used. Its October 6 statement says a contractor "failed to implement a security patch explicitly issued to secure the platform," so on the FBI's account a fix existed, but it has not named the platform, the patch or PeopleSoft. The June flaw, CVE-2026-35273, has been covered by an Oracle Security Alert since June 10, 2026, and Mandiant says "WAF rules and path-based blocking are not a substitute for patching."

We use a hosted applicant tracking system. Is this our problem or the vendor's?

The patching is the vendor's. Under North Carolina law, notifying your applicants is yours. Ask the vendor in writing how quickly it would tell you about a breach, and whether it keeps your data after you delete it.

What should an employee do if someone calls their home claiming to have company data?

Hang up, do not pay, and call a known number at the company to report it. Write down the number, time and what was said. The company should report it to IC3 or the FBI Charlotte field office, following the FBI's own guidance in PSA I-051526-PSA.

Should we pull our careers page offline until this is resolved?

Usually not. A careers page that only links to a hosted applicant system carries little risk by itself. The risk sits in the system that stores the applications. Check that system's owner and patch status instead.

Why does the FBI's May warning matter to a manufacturer?

It describes how this group applies pressure once it has data: contacting victims and their family members directly. For an employer, those victims are your employees. That is a people problem as much as an IT one. It belongs in your incident plan next to the technical steps.

Where we are: Preferred Data Corporation has worked on North Carolina back-office and plant-floor systems out of High Point since 1987. We go on site within 200 miles, including Greensboro, Winston-Salem, Charlotte and Raleigh. Call (336) 886-3282, email [email protected], or visit us at 1208 Eastchester Drive, Suite 131, High Point, NC 27265.