Ransomware gang ShinyHunters boldly attacked the FBI this week, alleging that it hacked into the FBI’s job site, defaced it, then stole sensitive records of employees and applicants, including human resources records of current employees.
The gang alleges that it exploited a vulnerability in Oracle’s PeopleSoft product that enabled remote code execution allowing them to download between two and three terabytes of data. The group released a sampling of the data to journalists, including FBI employees’ names, home addresses, telephone numbers, Social Security numbers, assignments, dates of birth, and details about relatives.
ShinyHunters says it attacked the FBI following an FBI cyber alert published in May that the gang alleges made false statements.
While ShinyHunters’ claims have not been verified, picking a fight with the agency that is responsible for prosecuting cyber crime is surely an escalation that the FBI will no doubt respond to in kind.
Those using Oracle’s PeopleSoft are urged to update the software with patches when they become available.