Federal Bureau of Investigation

Summary

The FBI is investigating a breach involving sensitive employment data after ShinyHunters claimed to steal FBI records and deface FBIJobs.gov. Researchers verified some stolen materials, but the volume of data taken remains unclear.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In the late week before September 30, 2026, the loosely connected cybercrime group ShinyHunters claimed responsibility for stealing sensitive employment data from the Federal Bureau of Investigation. The group also defaced the FBI’s jobs website, FBIJobs.gov, with a message taking credit for the attack. The site was temporarily taken down. The breach involved FBI employment information and raised questions about whether the attackers had penetrated bureau systems directly or obtained access through third-party software.

The FBI had not disclosed the precise scope of the theft or the technical path used to acquire the data. Media organizations and threat-intelligence researchers verified the authenticity of some of the stolen materials, but the amount taken remained unclear. Current and former FBI employees told NPR that the stolen tranche might contain several terabytes of text files. The reported material included job applications, promotion information, details of sensitive job postings, family information and medical data. The employment records also reportedly covered both current and former bureau personnel.

Google’s Mandiant said ShinyHunters was targeting a vulnerability in Oracle’s PeopleSoft human-resources software, which the FBI uses. Google disclosed the vulnerability and its exploitation in June, released a patch and reported that some customers had attempted to block exploitation with firewall protections. Mandiant said ShinyHunters had been able to bypass those controls. The FBI had not publicly confirmed that the PeopleSoft vulnerability was the route used in the FBI breach, and investigators were examining whether the hackers had reached the data through third-party software or the FBI’s own internal systems.

The breach became publicly known through reporting, and many employees first learned about it from media coverage. Some current and former personnel said they were frustrated by the bureau’s initial communication about which employees were affected and how their information would be protected. The FBI said it sent multiple bureau-wide communications within 24 hours of the public reporting. In a statement to NPR, a bureau spokesperson said the FBI was working “around the clock” to investigate the incident involving FBIJobs.gov and was in regular communication with anyone who might have been affected. The FBI also said it treated the security of its information and the safety of its workforce as top priorities.

On September 29, FBI Assistant Director for the cyber division Brett Leatherman posted a video saying the bureau was hunting the ShinyHunters members responsible for the theft. He encouraged the group’s members to come forward and share information or face the consequences. The message followed a recently announced arrest in Amsterdam of an alleged ShinyHunters member by the Dutch National Police, and the FBI thanked its Dutch partners for leading that operation. The arrest occurred before the theft of FBI personnel data. The reason for the breach, including whether the FBI operation motivated it, had not been established.

ShinyHunters said it did not intend to publish the stolen files. The group nevertheless gave the FBI a September 30 deadline to amend previously published press releases that it characterized as inaccurate. Even without an announced release, the stolen information could have been copied, transferred, used for further criminal activity or exploited by other criminal, terrorist or nation-state actors. Current and former FBI employees were preparing for the possibility that the information had been irretrievably compromised.

Retired FBI employees who had worked undercover said they could require protection measures such as relocation assistance or legal name changes if their information was exposed publicly. A former senior FBI official said the breach could be comparable in scale to the 2015 compromise of tens of millions of government employee records from the Office of Personnel Management. The United States attributed that earlier breach to the Chinese government and described it as an espionage operation intended to identify potential intelligence targets. In the FBI incident, the concern centered on whether the stolen personnel data could be used against exposed employees or otherwise weaponized.

The FBI said it was “aggressively” investigating the breach, including how the attackers obtained the sensitive employment information. It also said it would seek information that could support arrests of ShinyHunters members, although the timing of further arrests was not clear. As of the September 30 report, investigators had not publicly established the full volume of data taken, confirmed the initial access vector or identified everyone whose information was included.

Sources

Sources available to members: 1 source.