One Week After ShinyHunters' Claimed FBI Breach, Agents Say the Bureau Left Them in the Dark

Since hackers calling themselves ShinyHunters claimed on September 22 to have stolen data on thousands of current and former FBI employees, the bureau has neither confirmed nor ruled out how the breach happened. A week later, agents say they're still getting mixed signals about whether their own information was compromised.

"Management is lost," one former FBI agent still in contact with colleagues told CNN. "They're not providing any clear advice to agents." CNN reports the breach is being described internally as one of the most serious agency data incidents in years, with some employees left unsure whether they're affected and unimpressed by the security resources offered to victims.

An FBI spokesperson pushed back on that characterization, telling CNN that "FBI employees potentially impacted have received communication and notification multiple times within the last week, as recently as Saturday." The bureau said it responded through a "multi-division effort" working around the clock on incident response, tracking the alleged hackers and engaging partners.

What the Stolen Data Actually Contains

The breach traces back to FBIJobs.gov, the bureau's job application portal, which went offline after the hack and remained down as of Thursday, September 24, according to LiveNow from Fox. Stolen data reportedly includes Social Security numbers, dates of birth, emergency contacts, home addresses and phone numbers.

Reuters, in reporting carried by CBC, reviewed a 5,000-line spreadsheet the hackers say represents only a fraction of a claimed two-to-three-terabyte trove. That sample included assignments tying specific employees to field offices and, in some cases, to counterintelligence work against Chinese and Russian intelligence services and drug cartels.

Eric O'Neill, a former FBI counterintelligence operative who now runs the cybersecurity firm Nexasure AI, called the data "a foreign intelligence service goldmine" in comments to Reuters. "China would be incredibly interested to know the individuals who are working against it," he said.

Bloomberg News, in reporting picked up by Claims Journal, said one hacker shared documents appearing to show health reports on FBI employees, including references to medical conditions and prior mental health issues.

Why ShinyHunters Says It Did This

ShinyHunters told FBI Director Kash Patel and Brett Leatherman, the assistant director overseeing the bureau's cyber division, that the attack was retaliation for a May advisory in which the FBI labeled the group a "threat actor" that uses "real or exaggerated claims of access" to extort victims, according to LiveNow from Fox. The group demanded the FBI retract that characterization.

"This is not a ransom, coercion, or extortion," the group's message read, according to the same report. "Your federal policies do not apply here. This PSA is NOT financially motivated."

CNN and ABC 17 News both note that ShinyHunters has since claimed it never intended to publish the stolen data, but the group has a documented history of leaking data from other victims when demands aren't met. According to the cybersecurity firm Huntress, ShinyHunters has been active since 2019 and previously hit Salesforce, Jaguar Land Rover and AT&T.

What the FBI Still Won't Say

The bureau's public statement has not changed materially since the week began: "While the point of breach is still undetermined, whether a third-party or the FBI's enterprise, we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk."

Miriam Wugmeister, a data privacy and cybercrime attorney cited by LiveNow from Fox, said ShinyHunters' track record makes it likely the group did compromise the site in some form, even though the FBI hasn't confirmed that.

Some coverage has leaned harder into the hackers' own framing than others. LiveNow from Fox's initial report leaned on the hackers' direct message to Patel and Leatherman as its lede, though it did include an explicit "what we don't know" section flagging that the claims remain unverified. Bloomberg's reporting on the alleged medical records is the most sensitive claim in circulation and remains the least verifiable of any detail reported so far.

What remains unresolved: the FBI has not said whether it has determined the breach originated with a third-party contractor or its own systems, nor has it given a timeline for that determination. Agents told CNN they fear their home addresses could surface publicly while they're traveling with family, a safety concern the bureau has not directly addressed in its public statements. Whether ShinyHunters follows through on threats to leak more of its claimed two-to-three-terabyte trove remains the open question hanging over the bureau's ongoing investigation.