FBI Touts $1 Billion in Blocked Cyber Theft While Still Grappling With Its Own Data Breach

Since Dutch authorities arrested an alleged leader of the hacking group ShinyHunters on September 15, the FBI has been running two very different cyber storylines at once: a public victory lap over blocked theft, and a quieter scramble to contain fallout from a breach of its own systems.

Start with the number FBI Director Kash Patel wants people talking about. The bureau's Recovery Asset Team has denied more than $1 billion in attempted cyber theft since January 2025, according to figures the FBI Office of Public Affairs provided to Breitbart News. That's a 16 percent increase over the same period under the prior administration, per the bureau's own comparison.

The Recovery Asset Team runs the FBI's Financial Fraud Kill Chain, a process that races to freeze fraudulent wire transfers by coordinating with banks before money disappears overseas. In 2025 alone, the team launched roughly 3,900 of these actions against more than $1.1 billion in attempted theft and actually froze $679 million, a 58 percent success rate, according to the FBI's most recent Internet Crime Complaint Center report.

Patel tied the number to Operation Blackout, the bureau's campaign against overseas scam compounds. FBI Assistant Director Ben Williamson told Breitbart the operation has seized roughly $17 billion, arrested hundreds of suspects, freed thousands of trafficked workers, warned more than 10,000 Americans before they lost money, and prevented an estimated $660 million in additional losses. In May, the bureau reported an $8 billion cryptocurrency seizure and 275 arrests tied to nine raided compounds in Dubai, each allegedly generating about $6 million a year in fraud. In August, agents searched 28 buildings over three days at a roughly 200-acre compound in Cambodia known as OSmach Resort.

Patel has described these as fortified settlements, not call centers. "These are towns, these are cities," he told Fox News Digital. "These are actual villages with structures where they force people into forced labor." The bureau says older Americans make up the bulk of scam victims and that it has referred 99 victims for suicide intervention.

That's the win column. The other column is messier.

A cybercriminal group calling itself ShinyHunters claimed to have broken into the online portal hosting FBI job-applicant data, stealing Social Security numbers, emergency contact information, and home addresses, according to CNN. Some of the stolen data reportedly includes information on FBI personnel working in sensitive units focused on China and Russia, per sources who reviewed the material cited by CNN. The hackers initially demanded the FBI revise a prior advisory describing their tactics, a demand many in the cybersecurity industry read as an implicit threat to leak the stolen files, CNN reported. The group has since said it never planned to publish the data, though NPR notes the group has a history of doing exactly that to other victims.

Dutch authorities arrested a 24-year-old man they describe as an alleged ShinyHunters leader on September 15 and say they found additional evidence on his laptop afterward. He'll remain in pretrial detention for at least 90 more days, Dutch authorities said. FBI cyber division Assistant Director Brett Leatherman posted a video vowing to track down the rest of the group: "You know how to find us, and we know how to find you."

Inside the bureau, the response has drawn criticism. "Management is lost," one former FBI agent in contact with current colleagues told CNN. "They're not providing any clear advice to agents." NPR reported that many employees first learned of the breach from media coverage rather than from the bureau itself, and that retired agents who worked undercover may need relocation assistance or even new identities if their information surfaces publicly. A former senior FBI official told NPR the breach could rival the 2015 Office of Personnel Management hack, which the U.S. government attributed to China and which exposed tens of millions of federal employee records.

The FBI disputes the characterization that it went quiet. A bureau spokesperson told CNN that affected employees received multiple notifications within the past week, as recently as the prior Saturday, and told NPR the agency is working "around the clock" to determine whether hackers exploited third-party software or the FBI's own internal systems.

A billion dollars in blocked wire fraud and a $17 billion overseas seizure campaign are real, verifiable operational results, not just talking points. They show up in the bureau's own Internet Crime Complaint Center data. Breitbart's exclusive leans entirely into that framing and doesn't mention the ShinyHunters breach at all. CNN and NPR, meanwhile, focus almost entirely on the breach and internal criticism of Patel's leadership, without noting the recovery figures the bureau was simultaneously promoting. Both halves of the story are true. Neither outlet is telling the whole of it.

What's still unresolved: the FBI has not said publicly how many current or former employees' data was exposed, whether the intrusion came through FBIJobs.gov itself or a third-party vendor, or what protective measures, if any, will be offered to agents whose undercover identities may be at risk.