The Federal Bureau of Investigation has told its own workforce that personal information belonging to agents and support staff was stolen in a cyberattack on the bureau's job application portal, and has formally declared the episode a "cyber security incident." The development, reported on September 26 by MS Now correspondent Ken Dilanian and confirmed in subsequent coverage on September 28, marks the bureau's first internal acknowledgment that personnel data was actually taken — a significant escalation from its earlier public position that any theft was "still undetermined."
The attackers, a hacking collective operating under the name ShinyHunters, say they hold sensitive records on nearly the entire FBI workforce of roughly 38,000 people, plus a large volume of information on job applicants. They claim to have penetrated FBI systems through a vulnerability in an Oracle PeopleSoft server that hosts human-resources data for people who applied through the FBIJobs.gov portal. Unlike most headline-grabbing intrusions, the group says it is not seeking a financial ransom. Instead, it is demanding that the FBI retract or correct a May 2026 public advisory that, in the group's telling, misrepresents its activities.
The case is remarkable on several fronts: the victim is one of the world's premier counterintelligence agencies, the stolen data reportedly includes Social Security numbers, home addresses, and even medical information, and the alleged motive is reputational rather than financial. Here is what is known, what remains unverified, and why security experts say this breach matters far beyond the bureau's walls.
From a defaced portal to an internal alarm
The incident began in plain sight. On or about September 21 and 22, 2026, the ShinyHunters brand defaced the FBI's recruitment portal, fbijobs.gov, replacing official imagery with a mascot image and a banner reading "This site has been seized by ShinyHunters." The portal later displayed a scheduled-maintenance message and was still unavailable on September 25. The defacement alone made the intrusion impossible to dismiss as a mere rumor.
Around September 22 and 23, the group posted on its dark-web site claiming to hold data on "almost ALL FBI Agents and individuals who filed an application," naming affected systems including Criminal Justice (CJ), HR, Medlink, PEGA, PHIRE, and FBIJOBS, and asserting a total stolen volume of two to three terabytes. The FBI responded on the social platform X that it was "actively and aggressively" examining the allegation while working with the third-party providers that support FBIJobs.gov to mitigate risk and determine whether any compromise occurred on FBI systems or a contractor's platform.
In its first public comments, the bureau said it was aware that a hacking group had claimed a cyberattack, but that the theft of data was "still undetermined." That posture changed over the weekend of September 26, when Dilanian reported that the bureau had declared a "cyber security incident" in an internal notification to staff, telling employees that their names, addresses, job titles, and Social Security numbers were exposed. Subsequent reporting on September 28 added that several media outlets had confirmed some of the stolen data included medical information, such as records relating to blood and urine samples, as well as psychiatric reports.
What the hackers say they took
ShinyHunters told TechCrunch that it has data on "mostly all of FBI," along with a "substantial" amount of information on applicants who applied through the FBIJobs.gov portal. To back its claims, the group provided roughly 5,000 records to journalists, including the outlets 404 Media and Reuters. The sample reportedly contained names, home addresses, phone numbers, Social Security numbers, duty assignments, and job classifications — spanning special agents, intelligence analysts, attorneys, and student trainees — and in some cases the names of spouses, siblings, and other family members.
Reuters partially verified the sample against credit-bureau records, finding at least ten matches — including, reportedly, the FBI Director — but could not confirm that the data originated from FBI systems. That distinction matters: partial verification of a sample does not settle the question of whether the full claimed dataset of two to three terabytes is genuine, nor precisely which systems it came from. The FBI has not publicly confirmed the breach's scope beyond its internal notification to employees.
The group says it broke in by exploiting a vulnerability in an Oracle PeopleSoft server, which hosts extensive human-resources information on agents and former employees who applied through the portal. According to threat-intelligence reporting, ShinyHunters has been linked since June to the exploitation of a PeopleSoft flaw tracked as CVE-2026-35273, though it is not clear whether the FBI intrusion used that same vulnerability or a new one. PeopleSoft is widely deployed across government agencies, universities, and large enterprises, which is why the detail has set off alarms well beyond law enforcement: the same class of flaw could exist in thousands of other organizations' HR systems.
A demand with no ransom
What sets this case apart from most extortion campaigns is the absence of a financial demand. The group told TechCrunch it is not seeking money. Instead, it says the operation is retaliation for a May 15, 2026, FBI Private Industry Notification (public service announcement PSA260515) that described ShinyHunters' tactics — including harassment, swatting threats, and exaggerated-access extortion — and advised victims not to pay. The group has called the advisory "substantial false allegations" and "disinformation," denied any connection to the cybercrime collectives known as "The Com" and Scattered Spider, and threatened to publish the full dataset unless the FBI retracts or amends the notice by a deadline reported as one week from the incident, or September 28.
The demand puts the bureau in an unenviable position: negotiating with or conceding to a threat actor sets a dangerous precedent, while refusing risks the public release of extraordinarily sensitive personnel data. The group's message was addressed to FBI Director Kash Patel, underlining the personal and political dimensions of the standoff.
ShinyHunters has been tied to a string of high-profile intrusions, including an April incident involving Rockstar Games and a disruptive attack on the Canvas education platform in May. Its willingness to escalate from corporate targets to a federal law-enforcement agency signals a shift in operational posture that security researchers are watching closely.
Why experts say this is "as serious as it gets"
Professor Ciaran Martin, the former chief executive of the United Kingdom's National Cyber Security Centre, said that if the claims are verified, the incident would be
"as serious as it gets" for a data breach.
Cynthia Kaiser, a former senior FBI cyber official now with the Halcyon Ransomware Research Center, told NPR that the defaced portal alone established that at least part of the story was real, and warned of the counterintelligence implications of the data being in the wild:
"This is a gold mine for foreign actors, for other countries looking to figure out ways to target FBI employees, just know more about what might be going on at the FBI, what types of numbers there are, how they can target people, etc."
Kaiser added that her more immediate concern was physical safety: criminals who obtain home addresses could target agents and their families directly.
"I'm worried a little bit more about the short-term effects of criminals who could get their hands on this type of data and actually target FBI employees and their families at their homes."
The exposure of medical records and family details compounds the risk. Personnel files that include psychiatric evaluations and biological sample records are among the most sensitive data any employer holds, and their disclosure could be used for blackmail, targeted phishing, or recruitment approaches by hostile intelligence services.
What happens next
Several questions remain open. The FBI has declined to say who accessed the data beyond the group's claims, has not confirmed the full scope of the theft publicly, and has not said whether it will meet the group's deadline for retracting the May advisory. Threat researchers will be watching the group's dark-web leak site for any publication of the dataset, and federal investigators will be working to determine whether the intrusion reached beyond the jobs portal into core investigative systems — a scenario the FBI's current statements appear designed to rule out, but which the group's claims put in play.
For other organizations, the takeaways are immediate. Patch internet-facing enterprise software — especially human-resources platforms — without delay, since the alleged entry point is a widely deployed product. Review what your vendors and contractors hold on your behalf, because the bureau's incident involved systems supported by third-party providers. And treat any claim of a breach at a high-value target with disciplined skepticism: verify samples independently, as Reuters did, before accepting an attacker's characterization of what was taken.
The FBI, an agency that routinely investigates exactly this kind of crime, now finds itself the victim in a case its own employees are living through. That irony is not lost on the security community — and neither is the warning it carries: if the bureau's HR data can be exfiltrated, no organization's personnel files are safe by default.
Sources
