A criminal hacking group says it broke into the FBI's own jobs website, stole terabytes of personnel data, and is now daring the bureau to do something about it.
The group, known as ShinyHunters, claims to have compromised FBIJobs.gov and walked away with names, home addresses, Social Security numbers, assignment details, and even family members' names for nearly all current and former FBI agents, plus thousands of job applicants. The FBI confirmed it is investigating but has not verified the scope of the alleged theft. The jobs portal and the Special Agent Applicant Portal were both taken offline, ABC News reported.
If the claims hold up, the breach would rank among the most damaging cyberattacks ever carried out against a federal law enforcement agency, exposing the personal lives of the very people tasked with investigating hackers.
ShinyHunters directed a public message to FBI Director Kash Patel, framing the attack not as a money grab but as retaliation. The group objected to a May 2026 FBI public service announcement that labeled them "a cyber criminal group specializing in large-scale data breaches and extortion." They demanded the bureau retract that advisory, AP News reported.
In a statement shared with reporters, ShinyHunters declared:
"We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job."
Breitbart reported that the group claims to have exfiltrated between two and three terabytes of data, including personally identifiable information and protected health information on current employees, former employees, and applicants. ShinyHunters told 404 Media they exploited a zero-day vulnerability, a previously unknown software flaw, in Oracle's PeopleSoft platform to gain access to AWS GovCloud servers that hosted the jobs portal.
Two separate verification efforts have produced results that partially support the hackers' claims, though neither constitutes full confirmation.
404 Media cross-checked a sample of 5,000 purported agents' records and found that phone numbers matched names using open-source intelligence tools, Breitbart reported. Separately, Reuters was able to verify stolen FBI personnel data in at least nine cases by matching names, addresses, and Social Security numbers against credit bureau records. Dark-web intelligence firm District 4 Labs assisted in that verification, the New York Post reported.
Those checks do not prove the full scope of the alleged breach. They do, however, suggest that at least some of the data is real and tied to actual FBI personnel.
The bureau's public statements have been measured. In a statement provided to Fox News, the FBI said:
"The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."
A separate FBI statement, reported by AP News, acknowledged that the bureau "is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information."
Investigators have not publicly confirmed how much data was accessed, whether the zero-day exploit described by ShinyHunters was the actual attack vector, or how long the intruders may have had access to the system. The FBI has also not said whether it has begun notifying affected personnel or applicants.
What makes this breach unusual is the stated motive. Most large-scale data thefts end in extortion demands or dark-web data sales. ShinyHunters appears to have chosen a different path, at least publicly.
The group's May 2026 grievance centers on an FBI public service announcement that warned organizations about ShinyHunters' tactics. That advisory described how the group operates, Fox News reported, and included a pointed observation about the group's playbook:
"Threat actors often use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims."
ShinyHunters called those characterizations false and framed the FBI breach as a direct response. Whether the group will eventually attempt to monetize the stolen data remains an open question. Investigators will need to determine whether ShinyHunters has already shared or sold any portion of the records on underground markets.
The group is not new to high-profile intrusions. ShinyHunters has been active since at least 2019 and has been linked to breaches affecting Microsoft, AT&T, Ticketmaster, Rockstar Games, the Canvas learning platform, and multiple Ivy League universities, Fox News reported. That history makes the group's claims harder to dismiss as bluster.
The FBI itself has tracked ShinyHunters for years, which adds an uncomfortable layer to the situation: the bureau's own intelligence on the group did not prevent the group from allegedly turning the tables.
Authorities have not publicly confirmed whether the breach extended beyond the jobs portal to other FBI systems. Investigators have not said whether the Oracle PeopleSoft vulnerability has been patched or whether other federal agencies running the same software face similar exposure. No public results have been released about whether the stolen data includes classified assignment details or is limited to administrative personnel records.
The FBI has also not disclosed whether any agents have reported identity theft, targeted harassment, or physical safety concerns as a result of the alleged data exposure. For agents working undercover or in sensitive national security roles, even the release of home addresses and family members' names could create immediate danger.
The breach comes during a period of broader cybersecurity scrutiny across the federal government. If ShinyHunters did exploit a known software platform to reach cloud servers holding the personal data of law enforcement officers, the incident raises pointed questions about procurement standards, patch management, and the security architecture protecting federal hiring systems.
For thousands of FBI employees and applicants whose Social Security numbers and home addresses may now sit in the hands of criminals, the investigation's timeline matters. Every day without clarity is a day without answers about whether their families are at risk.
The FBI built its reputation on catching hackers. Now it has to explain how hackers caught the FBI.
