FBI Investigates ShinyHunters' Claim It Stole Data on Nearly All Agents

The FBI is investigating claims from the hacking group ShinyHunters that it breached the bureau's job-applicant website and stole sensitive personal data on thousands of current and former agents.

"The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII)," the bureau said in a statement Wednesday, September 23. "While the point of breach is still undetermined — whether a third-party or the FBI's enterprise — we are actively and aggressively investigating this matter."

FBIJobs.gov, the main portal for prospective agents and other applicants, went offline Tuesday, September 22, and remained down Wednesday, according to Fox News and the Epoch Times.

What ShinyHunters Claims

A representative of ShinyHunters told NBC News the group accessed the jobs portal on Monday, September 21, then pivoted to other agency systems, walking away with an alleged 2 to 3 terabytes of files. NBC News said it could not verify the extent of that claim, and Reuters, which reviewed portions of the data directly, reported the same limitation.

According to Reuters, as cited by Al Jazeera, the data includes granular detail about bureau officials' job assignments, including work against Chinese intelligence services, Russian intelligence, and drug cartels. A screenshot of a sample document reviewed by Fox News reportedly contained agents' names, home addresses, Social Security numbers, duty assignments, and in some cases family members' names.

NBC News said one former FBI agent confirmed the authenticity of a sample document the group provided as evidence. That is a single data point, not full verification of the group's broader claim to hold files on "almost ALL FBI Agents," language ShinyHunters used in a message addressed to FBI Director Kash Patel and cyber division assistant director Brett Leatherman, according to Breitbart's reporting of the Associated Press account.

Retaliation Over a May Warning

ShinyHunters says the alleged hack is payback for a May 2026 FBI public service announcement that named the group as a "cybercriminal group specializing in large-scale data breaches and extortion." That PSA told potential victims not to pay ransom demands and warned that ShinyHunters "may falsely claim to have sensitive or compromising information ... which frequently do not exist," according to the Epoch Times.

ShinyHunters is demanding the FBI retract that characterization within a week or it will publish the stolen files, per Breitbart's AP reprint. "This is not a ransom, coercion, or extortion," the group's message said. "Your federal policies do not apply here. This PSA is NOT financially motivated."

The FBI's own May advisory specifically warned that groups like ShinyHunters routinely exaggerate the scope of what they've stolen to pressure victims, whether for money or, in this case, for a public retraction. The bureau hasn't confirmed the size or contents of any stolen trove, and Reuters said its own attempts to reach individuals whose data had allegedly been exposed in the group's past breaches were unsuccessful. Whether ShinyHunters actually holds files on "almost all" FBI personnel, or a far smaller sample dressed up for leverage, is not yet established by any independent source.

A Group With a Track Record

ShinyHunters isn't a new name in federal cybercrime circles. The FBI has linked it to breaches of Rockstar Games, Microsoft, AT&T, Ticketmaster, Pluto TV and multiple Ivy League universities, plus a May 2026 breach of the Canvas learning platform that disrupted schools nationwide, according to Fox News. Anthropic said earlier in September it had detected hackers tied to the group attempting to misuse its AI tools.

A French national tied to the group, Sebastien Raoult, was sentenced in January 2024 to three years in prison and ordered to pay more than $5 million in restitution after the Justice Department said he and co-conspirators stole hundreds of millions of customer records and caused victim companies more than $6 million in losses, the Epoch Times reported.

Cynthia Kaiser, the FBI's former deputy cyber director and now a senior vice president at cybersecurity firm Halcyon, told NBC News the alleged exposure is dangerous regardless of its final scope, because agents routinely sign their names to court filings used to prosecute criminals. "This type of information could be used by criminals to target or physically harm FBI agents, personnel and their families," Kaiser said. "So I get concerned when you start thinking about physical addresses, who people's spouses are, all of that."

No charges have been filed and no formal breach has been confirmed by the FBI beyond acknowledging the claim and the ongoing outage of FBIJobs.gov. ShinyHunters' self-imposed one-week deadline to see the May PSA retracted lapses around September 29. Whether the bureau meets that demand, ignores it, or the group follows through on publishing files either way, remains the open question hanging over an investigation the FBI itself says is still trying to determine whether the breach originated inside its own systems or through a third-party contractor.