ShinyHunters Hackers Claim FBI Breach, Demand Bureau Retract May Warning Within a Week

A cybercriminal group known as ShinyHunters claims it broke into FBI systems and stole sensitive data on thousands of agents, employees and job applicants, then demanded the bureau retract a public warning about the group within one week.

ShinyHunters posted the claim to its dark-web leak site Tuesday and repeated it in an online chat with Reuters, according to Channel NewsAsia and CBC. "We have compromised the FBI," the group wrote. "We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job."

The FBI did not respond to requests for comment from Reuters, TechCrunch, PCMag or NextGov on Tuesday. No FBI statement confirming or denying a breach has been issued.

What's Verified So Far

404 Media first reported the breach claim after ShinyHunters provided a sample of roughly 5,000 records containing names, home addresses, phone numbers, dates of birth and, in some cases, spouse information, according to TechCrunch and PCMag.

Reuters, reporting through Channel NewsAsia and CBC, said it partially verified some of the sample by cross-checking names and address details against credit bureau records and data preserved by dark-web intelligence firm District 4 Labs. Reuters found matches in at least nine cases but could not confirm where the data actually came from or whether it was pulled from FBI internal systems as the hackers claim.

Gadget Review reported that a compromised-data lookup service linked some phone numbers in the sample to Department of Justice personnel. But matching a handful of names and numbers does not establish that a full database was stolen from the FBI, or how large the alleged haul actually is.

The FBI's jobs website and its Special Agent Applicant Portal both displayed maintenance or seizure notices Tuesday and were unavailable, according to NextGov and Fox News affiliates covering the story. Reuters said it could not verify the authenticity of a screenshot ShinyHunters shared showing a defaced FBI jobs page.

The Claimed Method and a Discrepancy

ShinyHunters told 404 Media, as reported by TechCrunch, that it exploited a zero-day vulnerability in Oracle PeopleSoft, a human-resources platform, then pivoted into an Amazon Web Services GovCloud environment to pull two to three terabytes of data. No official confirmation of that access path has surfaced.

Gadget Review flagged a specific discrepancy. TechCrunch and BleepingComputer reported back in June 2026 that ShinyHunters ran a broad campaign against Oracle PeopleSoft servers at more than 100 organizations, and that the group's attempt to breach an FBI PeopleSoft portal specifically had failed. Whether Tuesday's claim represents a later, successful attempt, a revised version of that earlier failed effort, or the group attaching the FBI's name to a separate campaign is not established by any source reviewed.

Why the Group Says It Did This

ShinyHunters says the breach is retaliation for a May 2026 FBI public service announcement from the bureau's Internet Crime Complaint Center that described the group's extortion tactics, including harassment of victims and their families and, in some cases, swatting, according to NextGov and PCMag.

The group denies using those tactics and is demanding the FBI correct or remove the report within one week, addressing the demand directly to FBI Director Kash Patel and Cyber Division Assistant Director Brett Leatherman, PCMag reported. "We wish to state unequivocally our threats and claims are very real," the group wrote. "Not exaggerated and never a bluff."

That is ShinyHunters' own characterization of its intent, not an independently confirmed fact. The FBI's May advisory, which ShinyHunters wants retracted, remains published and has not been withdrawn as of Tuesday.

Broader Pattern

This would mark the second known intrusion into an FBI system this year. Earlier in 2026, unidentified hackers broke into an FBI system used to manage real-time wiretap and foreign intelligence warrants, according to TechCrunch. Separately, an Iran-linked hacking group called Handala breached and leaked Director Patel's personal email account in what TechCrunch described as retaliation for U.S. strikes on Iran.

ShinyHunters has also claimed responsibility for a Florida DMV breach involving more than 200,000 driver records, confirmed by state officials as originating from a single Plant City Police Department employee's compromised credentials, according to Fox News. The group is separately linked to breaches at Rockstar Games and the Canvas education platform, and Anthropic said this month it caught ShinyHunters-linked actors trying to misuse its AI tools, Channel NewsAsia reported.

What Happens Next

The FBI has one week from Tuesday's post to respond to ShinyHunters' demand before the group says it will act on its threat, though it has not specified what that action would involve. No law enforcement agency has confirmed the scope of any data theft, and the authenticity of the full claimed dataset, beyond the roughly 5,000-record sample reviewed by 404 Media and partially checked by Reuters, remains unverified.