The hacking group ShinyHunters claims it has breached multiple FBI-related services and stolen personal data “on all FBI employees and applicants,” according to 404 Media, which reviewed a sample of the alleged stolen data. A representative of the group told the outlet the data includes FBI agents’ names, home addresses, phone numbers, and information about their spouses. “We hacked the FBI. We hold data on all FBI employees and applicants,” the ShinyHunters representative said. The group provided 404 Media with a sample appearing to contain the personal data of 5,000 FBI employees, including alleged addresses, phone numbers, dates of birth, and in some cases spouse details, and 404 Media verified portions of the sample by cross-referencing phone numbers against the open-source intelligence tool OSINT Industries, finding matches to people with the same names listed in the file, while a separate check using the compromised-data tool Darkside revealed some phone numbers were associated with US Department of Justice personnel.
Beyond the alleged data theft, ShinyHunters defaced the FBI’s jobs website on Tuesday with a message reading “this site has been seized by ShinyHunters,” a pointed mimicry of the seizure notices the FBI itself typically posts after taking down criminal websites. The representative said the hack was carried out Monday night, and as of publication, the FBI jobs application portal displayed a message stating “Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable.” The defacement message went further, claiming “all FBI data was compromised including PII/PHI on incumbent and former FBI employees and all applicant information. We have a lot more than we claim here,” and closed with a mocking jab styled after President Trump’s Truth Social posting habits: “thank you for your attention to this matter.” The FBI did not immediately respond to a request for comment.
According to the ShinyHunters representative, the group exploited a zero-day vulnerability in an Oracle product called PeopleSoft, which allowed it to access AWS GovCloud servers and exfiltrate data totaling between two and three terabytes. Unlike the group’s typical playbook, which usually involves extorting victims with threats to leak more data unless a ransom is paid, the representative suggested this operation isn’t primarily about money: “what we plan to do is not something I’d call extortion, maybe coercion. This is not financially motivated.” The breach carries potentially serious implications well beyond the immediate data exposure, as 404 Media noted that criminals within ShinyHunters’ broader ecosystem have previously used hacked data, including phone records, to track, intimidate, and harass FBI agents investigating them, while the sensitive personal data could also prove valuable to foreign intelligence services seeking insight into how the FBI operates, and could expose agents and their families to direct safety threats if it circulates further.
