FBI hacked? ShinyHunters claims massive FBI hack, stealing data on ‘all FBI employees’ and their spouses

The hunter may have become the hunted.

ShinyHunters, one of the internet’s most notorious hacking groups, claims it breached the FBI and stole sensitive personal information belonging to nearly every FBI employee, former employee, and job applicant. A sample provided to journalists contains names, home addresses, phone numbers, dates of birth, Social Security information, and, in some cases, details about employees’ spouses.

“We hacked the FBI. We hold data on all FBI employees and applicants,” a ShinyHunters representative told 404 Media, which first reported the breach Tuesday.

The publication received a sample appearing to contain records on roughly 5,000 FBI employees. Its checks found that some phone numbers matched people with the names in the files, and some numbers were tied to U.S. Department of Justice personnel.

“A sample of 5,000 alleged agents seen by 404 Media includes names, addresses, phone numbers, and details on FBI employees’ spouses,” 404 Media reported.

Reuters conducted its own checks against credit bureau records and previously compromised data maintained by cyber intelligence firm District 4 Labs. At least nine records appeared to match. Reuters could not determine where the information originated or independently confirm that it was stolen from FBI systems.

The FBI has begun investigating. “The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating,” an FBI spokesperson told 404 Media.

ShinyHunters claims an Oracle PeopleSoft zero-day opened the door

ShinyHunters says the intrusion began Monday night through a previously unknown vulnerability in Oracle PeopleSoft, software commonly used for human resources and applicant management.

The hackers told BleepingComputer that the flaw allowed remote code execution and gave them an entry point into FBI systems. From there, the group claims it moved into FBI-managed AWS GovCloud infrastructure and downloaded between 2TB and 3TB of data. ShinyHunters says it accessed services connected to human resources, criminal justice, medical information, employees, and job applicants. Those technical claims have not been independently verified.

The group appears to have left a calling card. The FBI jobs website was defaced with a message declaring, “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since ’19 😉”. The site later showed that Apply.fbijobs.gov and the Special Agent Applicant Portal were unavailable.

The latest incident comes nearly five years after hackers compromised an FBI email system in November 2021 and used it to send more than 100,000 fake emails warning recipients about a supposed cyberattack. Reuters reported at the time that the attackers exploited the bureau’s Law Enforcement Enterprise Portal email infrastructure, though the FBI said it took the affected system offline and that no data was accessed or compromised.

If the broader claims prove accurate, the consequences extend far beyond a conventional data breach.

Names paired with home addresses, phone numbers, family information, Social Security numbers, employment records, and other personal data could expose federal agents to harassment, impersonation, extortion, surveillance, or physical threats. Such a dataset could carry counterintelligence value for foreign governments seeking information about FBI personnel and their relationships.

ShinyHunters says money is not its motive. The group claims the operation is retaliation for an FBI report published in May that described its tactics and warned victims against paying extortion demands. ShinyHunters has given the FBI one week to correct or remove that report.

When 404 Media asked whether the group planned to extort the bureau, its representative replied, “What we plan to do is not something I’d call extortion, maybe coercion.”

“This is not financially motivated,” the representative added.

For now, one of the biggest questions remains unanswered: just how much FBI data did ShinyHunters actually obtain?

The 5,000-record sample and Reuters’ independent matches provide evidence that at least some of the data is real. They do not yet establish ShinyHunters’ extraordinary claim that it obtained information covering nearly the FBI’s entire workforce and applicant pool.

The FBI investigation may determine whether this was a breach of limited recruiting infrastructure or something far more serious.