FBI Confirms Investigation as ShinyHunters Hackers Claim Theft of Agents' Personal and Medical Data

The FBI is still working to determine how much of its workforce data a cybercriminal group actually stole after the group defaced the bureau's job-application website on Monday, September 22, and began circulating what it says are stolen personnel files.

What ShinyHunters claims

The group ShinyHunters told the outlet 404 Media it holds "data on all FBI employees and applicants" and defaced apply.fbijobs.gov with a message styled like a law enforcement seizure notice: "This site has been seized by ShinyHunters." The FBI's Special Agent Applicant Portal went dark the same day and remained unavailable through Wednesday, September 24, according to Fox News.

ShinyHunters told 404 Media it exploited a zero-day flaw in Oracle's PeopleSoft software to reach FBI systems hosted on Amazon Web Services' GovCloud, then pulled two to three terabytes of data. The FBI has not confirmed that vector. Its statement to multiple outlets, issued September 23, said: "While the point of breach is still undetermined, whether a third-party or the FBI's enterprise, we are actively and aggressively investigating this matter."

Samples reviewed by 404 Media covered roughly 5,000 purported agents and included names, home addresses, phone numbers, dates of birth and spouses' information. A cross-check using the OSINT Industries tool matched phone numbers to the listed names, and a separate check using the tool Darkside turned up phone numbers tied to Justice Department personnel, according to 404 Media. Fox News reported that a sample screenshot shared with Reuters also contained Social Security numbers and agents' assignments.

BBC News went further, reporting it reviewed samples of stolen "fitness-for-work" medical exams containing blood work and other health data tied to thousands of special agents. BBC said the records appear to include senior officials up to the deputy director level.

Why the FBI, specifically

ShinyHunters says the motive isn't money this time. The group told Reuters and posted on its dark-web site that it targeted the bureau because of a May 2026 public service announcement in which the FBI detailed ShinyHunters' extortion tactics, including exaggerated claims of access, threatening calls to victims' families, and swatting. The PSA advised victims: "Do not send payment or respond to their demands."

ShinyHunters called the report's contents "false allegations" and, according to Breitbart and the Epoch Times, gave the FBI one week from its September 22 post to correct or remove it. Separately, BBC reported the group is threatening to publish the full stolen databases within four days of its claim unless unspecified demands are met. Those two deadlines point toward the coming days, meaning the outcome of this dispute could become public within the next several days.

What isn't confirmed

Reuters, which questioned ShinyHunters directly in an online chat, told the Epoch Times it could not verify the group's claims and was unable to reach any alleged victims whose data had supposedly been compromised. As of now, no independent outlet has confirmed the full scope of what was stolen. Only samples reviewed by journalists appear to be genuine, and the FBI's applicant portal was confirmed to be taken down.

Agents describe fear, not just inconvenience

BBC News spoke with current and former agents in a group chat comparing notes on the breach. One former FBI cyber investigator told BBC the exposure of home addresses and family details could fuel "violence-as-a-service" attacks from online gangs settling scores with agents who worked their cases, and raised the specific fear of swatting.

Michael McPherson, a former FBI agent now senior vice president of security operations at ReliaQuest, told BBC the breach "cuts to the core of agent safety, particularly their families," noting that spouses and children "normally insulated" from the risks of the job could now be exposed.

A pattern of hitting the investigators

CNN, citing two sources familiar with the matter, placed the breach in a broader pattern of hackers going after the law enforcement agencies chasing them. CNN noted a suspected March breach of a sensitive FBI network used to manage wiretap and surveillance warrants, a Russian-speaking group's leak last month of files from the ATF covering past investigation targets, a 2023 ransomware attack on the U.S. Marshals Service targeting subjects of its own investigations, and a 2023 breach of an FBI New York field office system tied to child exploitation cases, including material connected to the Jeffrey Epstein probe.

ShinyHunters has a track record beyond this incident. A French member of the group, Sebastien Raoult, was sentenced in January 2024 to three years in prison and ordered to pay more than $5 million in restitution for wire fraud and identity theft conspiracy, according to the Justice Department. The group has also been tied to breaches at Rockstar Games, AT&T, Ticketmaster and the Canvas education platform used by schools nationwide, per Fox News and Breitbart.

The FBI has not said publicly how many current or former employees' records were actually exposed, nor confirmed the PeopleSoft/AWS GovCloud attack chain ShinyHunters described. Whether the group follows through on its threatened data dump in the coming days, and whether the FBI's investigation contradicts or confirms the hackers' account of how they got in, remain open questions the bureau has not yet answered.