The FBI is investigating a suspected cyberattack on its job application website after the group ShinyHunters claimed to have stolen over 2 terabytes of data, including sensitive personal details on thousands of bureau employees and applicants.
The FBI confirmed it is looking into unauthorized activity on FBIjobs.gov, and the site’s Special Agent application portal was down on Tuesday. On its dark-web page, ShinyHunters claimed to have obtained highly sensitive data covering nearly all FBI agents as well as job applicants, and said it had also gained access to the bureau’s criminal justice, HR, and other internal systems.
It could not be independently confirmed whether the leaked data was authentic or current, though cybersecurity researchers told the outlet the breach itself looked genuine. Separately, the media reviewed a sample of the alleged stolen data that appeared to include records on roughly 5,000 people identified as FBI agents.
What was allegedly taken
ShinyHunters said the stolen data included names, agent status, email addresses, phone numbers, home addresses and, in some cases, information about spouses, including Social Security numbers. The group also claimed to have exploited a previously unknown flaw in Oracle’s PeopleSoft software to break into and deface the FBI’s jobs site, which remained offline Tuesday afternoon.
Security experts warned the exposure could create lasting risks for FBI staff and their families if the data spreads among criminal networks or ends up for sale on the dark web. Allan Liska, a threat intelligence analyst at Recorded Future, said the data was likely to be repeatedly downloaded and shared with other threat actors if it had been obtained as claimed, while Andrew Brandt of Huntress said the bigger worry was whether ShinyHunters would go on to sell the data to criminal or state-backed hackers.
Why target the FBI?
ShinyHunters claims the attack wasn’t about money, instead, the group is demanding the FBI walk back or amend public statements about its activities. That follows a May FBI advisory warning that the group often relies on harassment tactics against victims and their families, including threatening calls, messages, and swatting. ShinyHunters pushed back on that characterization, telling Axios that less-skilled actors have been carrying out attacks under its name without authorization.
The FBI has not confirmed the attackers’ identity or the scope of any compromised data.
Part of a broader pattern
This comes amid a string of cyber incidents targeting US law enforcement. The FBI was also investigating a separate suspected breach in March involving a sensitive system used to manage wiretap and surveillance warrant operations. Last month, hackers leaked files allegedly stolen from the ATF, which appeared to contain sensitive material from past investigations. The FBI has faced similar incidents before, including a 2023 breach affecting a system its New York field office used for child exploitation cases.
