ShinyHunters, an international hacking group, says it breached FBI systems and stole between two to three terabytes of sensitive data on employees and job applicants. The FBI has confirmed that it is investigating claims of unauthorised activity affecting FBIjobs.gov, its recruitment website. It has not confirmed that internal systems were compromised or that the group obtained the material it says it holds.
The group says it used a zero-day vulnerability in Oracle PeopleSoft, a software system used for personnel-related functions, to reach AWS GovCloud servers connected to FBI recruitment services. It claims to have then accessed the jobs portal, human resources, criminal justice and other internal systems. The technical details of the alleged exploit have not been established publicly.
ShinyHunters announced the claimed breach on dark web forums and released a sample of data. It says the material includes names, addresses, phone numbers, birth dates and identification numbers. In some cases, it says, the files contain spouse information, including Social Security numbers.
The group says the affected personnel include staff involved in counterintelligence work against Chinese and Russian intelligence, narcotics cartels and terrorism. Its sample includes information on approximately 5,000 FBI agents and job applicants, according to the group. It also contains a 5000-line spreadsheet listing details of employees' tasks.
Reuters said it was able to partially verify data in the sample, including information associated with FBI Director Kash Patel. 404 Media separately found that some phone numbers in the sample matched people identified by the listed names. Those checks do not establish the full scale of the claimed breach or confirm the group's account of how it obtained the files.
FBIjobs.gov became inaccessible and displayed a banner saying it had been seized by ShinyHunters. The group also placed an image of the Pokémon Umbreon on the site. The FBI said it was aware of claims concerning unauthorised activity affecting FBIjobs.gov and was investigating. The bureau has not said when the site will be restored, and the current status of the portal is unknown.
ShinyHunters says the operation was a response to an FBI advisory published in May 2026. The group says the bureau's warning described its harassment tactics, including threatening calls and swatting. It maintains that the FBI mischaracterised its methods, though the extent to which the advisory referred to particular acts by the group or broader threat patterns is unclear from the available information.
The group has demanded that the FBI retract the advisory within one week and threatened further consequences if it does not. It said the action was not financially motivated and called its aim “coercion” rather than extortion. ShinyHunters has demanded ransoms from data-breach victims in earlier operations, according to the brief.
Cybersecurity researchers told Axios that the attack appeared legitimate on the basis of the evidence presented. The FBI has yet to verify whether the alleged intrusion reached core intelligence or operational systems. It is also unknown whether any stolen data has been sold or shared, whether other government agencies or contractors faced exposure through the same vulnerability, and whether the group will carry out further attacks or release more material.
Four French men were arrested in connection with ShinyHunters in May 2026. The identities of the people responsible for the alleged FBI operation remain unknown. So does the total number of FBI employees and applicants affected beyond the approximately 5,000 records in the released sample.
Comments (0)