A criminal hacking group says it stole personal information on nearly every FBI agent and applicant through the bureau's jobs website, and the FBI still cannot say whether the breach came from inside its own systems or a third-party vendor.
The FBI acknowledged the claimed compromise of FBIJobs.gov in a post on X, stating it is "actively and aggressively investigating" after the group known as ShinyHunters said it had obtained names, home addresses, Social Security numbers, work assignments, and in some cases the names of agents' family members. The bureau said the "point of breach is still undetermined, whether a third-party or the FBI's enterprise," Fox News Digital reported.
ShinyHunters, described as a criminal hacking and extortion group, claimed it had stolen data "on almost ALL FBI Agents, and individuals who filed an application with the FBI for a job." The group told reporters the breach was carried out in retaliation for a May 2026 FBI advisory that publicly detailed ShinyHunters' methods, the New York Post reported.
That is a staggering claim. If even partially true, the breach would expose the personal details of thousands of current and former federal law enforcement officers and the civilians who sought to join them.
Reuters reported that it received a sample of the stolen data and was able to partially verify its authenticity by cross-referencing names, addresses, and Social Security numbers against credit bureau records. The wire service found matches in at least ten instances, including details matching FBI Director Kash Patel. A dark-web intelligence firm, District 4 Labs, also helped verify portions of the data.
Separately, Breitbart reported that the outlet 404 Media verified a sample of 5,000 purported FBI agents' records, with phone numbers cross-checked and confirmed through open-source intelligence tools. ShinyHunters told 404 Media directly: "We hacked the FBI. We hold data on all FBI employees and applicants."
The FBI's jobs website and its Special Agent Applicant Portal were confirmed to be unavailable, which lent further weight to ShinyHunters' claims. The group also reportedly defaced the jobs site as proof of the intrusion.
ShinyHunters claims to have exploited a zero-day vulnerability, an unknown software flaw, in Oracle's PeopleSoft platform, and says it accessed Amazon Web Services GovCloud servers, downloading between two and three terabytes of data. Those claims have not been independently confirmed by the FBI or Oracle.
Director Patel has been reshaping the bureau's internal structure since taking over, and this breach now adds an urgent cybersecurity crisis to his plate.
Jason Pack, a retired FBI supervisory special agent and CEO of Media Rep Global Strategies, told Fox News Digital that the public should understand the difference between a personnel data breach and a compromise of classified systems.
"There is a meaningful difference between somebody obtaining personnel information and somebody gaining access to classified investigative systems. Based on what we know right now, there is no indication they have the keys to the kingdom."
But Pack was clear that stolen personnel data is far from harmless. He warned that adversaries who know an agent's name, workplace, and assignment can craft highly targeted scams, the kind of tailored phishing and social engineering that catches even careful people off guard.
"If an adversary knows who somebody is, where they work and what they do, they can build a much more believable scam around that person."
The danger extends well beyond fraud. Pack raised a counterintelligence concern that should trouble anyone who cares about national security: foreign intelligence services could use assignment data to identify FBI personnel worth approaching, surveilling, or recruiting.
"If a foreign intelligence service can associate particular people with certain assignments, it can help them identify individuals they may want to learn more about, approach or potentially assess for recruitment."
Pack cautioned that he was not claiming foreign recruitment was happening in this case. "It simply explains why assignment information can have value to an adversary," he said.
The FBI has faced heightened scrutiny over security vulnerabilities in recent months, and a breach of this nature, if confirmed at the scale ShinyHunters claims, would represent one of the most significant exposures of federal law enforcement personnel data in years.
One of Pack's sharpest warnings concerned the long tail of stolen data. Patching the vulnerability that allowed the breach, he said, does not neutralize the threat.
"The danger from stolen personal information does not necessarily end when the computer vulnerability is fixed. Criminals may hold onto that information and use it weeks or months later."
Cynthia Kaiser, a former FBI official now serving as senior vice president at cybersecurity firm Halcyon, echoed that concern. "Once that information is stolen, it is used forever," Kaiser told Reuters.
That timeline matters. Agents whose Social Security numbers and home addresses are now circulating among criminal networks face identity theft, targeted fraud, and potential physical security risks, not for a news cycle, but indefinitely. The same applies to every civilian who submitted a job application through FBIJobs.gov and trusted the federal government to protect their information.
Federal law enforcement agencies have confronted serious national security threats on multiple fronts this year, and the exposure of agent identities and assignments adds a new dimension to the challenge.
The bureau's public statement acknowledged the breach claim and pledged an aggressive investigation, but left major questions unanswered. The FBI has not confirmed how many individuals' records were accessed. It has not said whether affected employees and applicants have been notified. It has not identified which third-party providers support FBIJobs.gov or whether those vendors have been secured.
The FBI has also not addressed whether classified investigative systems were accessed, Pack said there is no current indication of that, but the bureau itself has not made a definitive statement either way. And no criminal charges or arrests related to ShinyHunters' claimed role have been announced.
ShinyHunters' stated motive, retaliation for the FBI's May 2026 public advisory about the group, raises its own set of concerns. If a routine law enforcement bulletin about a criminal group's tactics provoked a breach of this magnitude, it suggests the bureau's public-facing digital infrastructure was far more vulnerable than anyone should be comfortable with.
Recent FBI disclosures, including newly released investigative documents, have already drawn public attention to how the bureau handles sensitive information. A confirmed breach of employee data would intensify that scrutiny considerably.
The FBI asks Americans to trust it with the most sensitive work in federal law enforcement. When a criminal group can plausibly claim it stole the personal data of nearly every agent in the bureau, and outside reporters can verify chunks of it, that trust has a problem only transparency and accountability can fix.