The FBI is investigating claims that the hacking group ShinyHunters compromised systems connected to the bureau’s jobs portal and obtained sensitive information tied to current and former employees as well as job applicants.
ShinyHunters publicly claimed responsibility for the intrusion, saying it had obtained large amounts of personnel information connected to the bureau.
“We have compromised the FBI,” the group wrote in a message directed at FBI Director Kash Patel and Brett Leatherman, the assistant director of the FBI’s Cyber Division.
The hackers claimed they possessed “very sensitive data” involving almost all FBI agents and individuals who had applied for jobs with the bureau.
The FBI has not publicly confirmed the full extent of the hackers’ claims.
In a statement, the bureau said it was aware of claims involving FBIJobs.gov and possible exposure of personally identifiable information.
The FBI added that investigators had not yet determined whether the breach originated from a third-party provider or from within the bureau’s own systems.
“We are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk,” the bureau said.
ShinyHunters claimed the attack was retaliation for an FBI advisory issued in May that described the group’s cybercrime tactics and advised victims against paying hackers.
The group demanded that the FBI correct or remove the advisory within one week.
ShinyHunters also claimed that its actions were not financially motivated.
The hackers said they had obtained between two and three terabytes of information, though the FBI has not publicly verified that figure, per Trending Politics.
The group further claimed the data covered tens of thousands of current and former FBI personnel and job applicants.
404 Media first reported the alleged breach after receiving a sample containing approximately 5,000 records.
The sample reportedly included names, home addresses, telephone numbers, dates of birth and, in some cases, information involving spouses or emergency contacts.
ABC News reported that portions of the information appeared consistent with public records and other available data, though the outlet said it had not independently obtained or verified all of the allegedly stolen material.
Reuters separately reported that a spreadsheet linked to the alleged breach contained Social Security numbers and job-related information.
Some of the listed assignments reportedly involved sensitive areas such as China, Russia, drug cartels, cyber operations and intelligence collection.
Reuters said it was able to partially verify some of the information by comparing it with other records, but could not establish that all of the data originated directly from internal FBI systems.
ShinyHunters has also claimed that it gained access through a previously unknown vulnerability involving Oracle PeopleSoft.
The FBI’s application portal uses Oracle technology for job applications and applicant information.
The hackers additionally claimed they were able to move into Amazon-hosted government cloud infrastructure after gaining initial access.
Those claims have not been fully confirmed by federal officials.
The FBIJobs.gov portal was taken offline after the incident and displayed a maintenance or unavailable message while investigators assessed the situation.
The bureau has not confirmed reports that medical records, badge numbers or highly specific intelligence assignments were taken directly from its systems.
Separate reporting has raised concerns that medical information tied to FBI personnel may also have been exposed, including fitness-for-duty records.
The FBI continues to assess what information may have been compromised and how the attackers gained access.
If ShinyHunters’ broader claims are confirmed, the incident could represent a significant exposure of personal information involving federal law-enforcement personnel and applicants.
For now, however, the exact scope of the breach remains under investigation, and federal officials have not verified all of the hackers’ claims.
