ShinyHunters Claims 60,000 FBI Files Stolen, Sets Deadline

CYBERSECURITY

A criminal hacking crew says it broke into the FBI's job portal through an Oracle zero-day, raided the bureau's cloud servers, and walked away with the personal data of thousands of agents. The FBI has confirmed an incident — and says it still doesn't know where the breach began.

Published September 28, 2026 · By Daniel Rao

The J. Edgar Hoover Building, FBI headquarters in Washington, D.C. The bureau confirmed a cybersecurity incident involving its FBIJobs.gov portal after the ShinyHunters extortion crew claimed to have stolen thousands of personnel files. Photo: ajay_suresh / Wikimedia Commons (CC BY 2.0). File photo; the building is not connected to the breach.

The Federal Bureau of Investigation is investigating a breach of its own house. On Tuesday, September 22, the data-theft and extortion crew known as ShinyHunters announced it had hacked the bureau — defacing its job-application portal, claiming to have stolen the personal files of thousands of current, former, and prospective FBI employees, and addressing its taunt directly to FBI Director Kash Patel. The bureau confirmed on Wednesday that it was investigating the claims, confirmed again on Friday, and as of this weekend the jobs portal was still offline.

The story reads like a parody of institutional power: the agency that warns the public about cybercriminals got hit by the very crew it had publicly called out. But the substance is serious. If even part of ShinyHunters' claim is true, criminals now hold the names, home addresses, Social Security numbers, and family details of America's federal law-enforcement officers — and journalists who have seen samples say at least some of the data checks out.

What the hackers claim they took

ShinyHunters' account is specific about the intrusion. The group says it found a brand-new zero-day flaw in Oracle PeopleSoft — the software behind the FBIJobs.gov portal — on Monday night, September 21, and used it immediately for remote code execution. From the portal, it says, it moved laterally into the FBI's managed servers on AWS GovCloud and downloaded roughly two to three terabytes of data, including thousands of personnel files belonging to current, former, and prospective FBI employees.

The defacement was theatrical. Hackread observed on September 22 that apply.fbijobs.gov — the portal where Americans begin the process of applying for FBI jobs — had been replaced with a page reading "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS," complete with the group's branding and a link to its dark-web data-leak site. The message also claimed the group held personally identifiable information and protected health information involving current and former FBI employees, as well as applicants.

The group's own communiqué, posted online and addressed to FBI Director Kash Patel and Brett Leatherman, the assistant director in charge of the bureau's cyber division, made the grandest claim of all: "We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job."

Read that with the appropriate skepticism — criminal crews inflate. But the group has a track record that makes dismissal risky. The Register describes ShinyHunters as a data theft and extortion crew that has stolen sensitive information belonging to millions of cancer patients, university and K-12 students, and Carnival cruise passengers. Two weeks ago, this same crew dumped hundreds of thousands of stolen driver records from Florida's DAVID database — a breach we covered here — after the state refused to pay. The group knows how to get inside systems, and it knows how to make the resulting spectacle impossible to ignore.

What the FBI is — and isn't — saying

The bureau's public response has been cautious to the point of opacity. Its September 23 statement, released in full by the FBI National Press Office, reads:

"The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the fbijobs.gov portal and alleged impact to FBI employee personally identifiable information (PII). While the point of breach is still undetermined—whether a third-party or the FBI's enterprise—we are actively and aggressively investigating this matter and working closely with those third-party providers that support fbijobs.gov to mitigate any and all risk."

Note what the statement confirms and what it doesn't. It confirms the bureau is treating the claims as a real incident. It pointedly does not confirm — or deny — the scale of the theft, the zero-day allegation, or whether employee data actually left the building. On Friday, the bureau confirmed the breach again to The Register, which reported the FBIJobs.gov portal remained down. NewsNation's update this weekend characterized the bureau as confirming its involvement in a "cybersecurity incident."

The Associated Press reported on September 23 that the claims could not immediately be verified, and that an email to an address associated with ShinyHunters was not immediately returned. The FBI has not said when the portal will come back online, how many personnel are affected, or whether affected employees have been notified.

What journalists have verified so far

This is where the story gets harder for the bureau to minimize. Independent checks of the stolen samples suggest the data is not fabricated from thin air.

404 Media received a sample allegedly covering 5,000 employees, and reviewers said at least some of it appeared authentic. Reuters independently found matches in at least ten instances — including, strikingly, a record for FBI Director Kash Patel himself. A former FBI agent confirmed a sample document to NBC News. According to Axios, which spoke with the group, the data includes names, agent statuses, emails, phone numbers, home addresses, and sometimes spouse information — including Social Security numbers.

None of that proves the group's headline claim of "almost ALL FBI agents." Verification of samples proves the crew got inside and took something real; it does not prove the volume. But the verification pattern — multiple outlets, multiple independent confirmations, matches against the bureau's own director — is considerably stronger than the usual post-hack bragging.

Jason Pack, CEO of Media Rep Global Strategies and a retired FBI supervisory special agent, told Fox News Digital that the distinction investigators must now draw is critical: "There is a meaningful difference between somebody obtaining personnel information and somebody gaining access to classified investigative systems. Based on what we know right now, there is no indication they have the keys to the kingdom."

The grudge behind the attack

ShinyHunters says this was not about money. It was about revenge — and the target of the revenge is a public document.

In May, the FBI issued a public service announcement warning of a cybercriminal group specializing in large-scale breaches and extortion — a group that used "real or exaggerated claims of access to sensitive information to prompt payment from victims." The PSA was understood to describe ShinyHunters, whose attack on the Canvas learning platform had hit universities and schools nationwide.

The group says the PSA was an attack on its business. Analysts who spoke to CyberScoop said the crew's statement on its leak site portrayed the FBI's PSA as "an attempt to disrupt our operations and hinder clients' trust in our organization hoping nobody pays us." The group's demand, posted alongside the breach claim: the FBI should correct or take down the May PSA. It gave the bureau one week from the September 22 post.

A ShinyHunters spokesperson told The Register the crew hacked the FBI to "protect our business." "It's a game and it's the world we live in," the spokesperson said. "We are just protecting our business as any other business would do. It's about who does their job better."

Cynthia Kaiser, senior vice president at Halcyon's ransomware research center, told CyberScoop the move was deliberately provocative: "The ShinyHunters ransomware group appears to be actively trying to put a target on their back." Former FBI counterintelligence operative Eric O'Neil told Reuters: "They're really trying to scare the hell out of the FBI."

The audacity is the strategy. Extortion crews run on reputation: the threat of publication only works if victims believe the crew can and will follow through. By humiliating the FBI — the agency whose PSA questioned the crew's credibility — ShinyHunters is advertising to every future victim that it is not a paper tiger. The one-week deadline for the PSA takedown, whether or not the bureau complies, is secondary to the performance itself.

The zero-day question

The most technically alarming claim is the entry point: a brand-new, unpatched zero-day in Oracle PeopleSoft, discovered Monday night and weaponized the same evening.

There is no public CVE for the claimed flaw, and Oracle has not confirmed it. But ShinyHunters' history with this exact software family lends the claim weight it might not otherwise have. The group previously exploited CVE-2026-35273 — a critical remote-code-execution flaw in PeopleTools — as a zero-day against more than 100 organizations, mostly in higher education, before Oracle patched it on June 10, 2026. If the new claim is accurate, systems patched for the earlier flaw could still be exposed, and the group says the flaw remains unpatched with more targets planned.

FBI documents, cited by security researchers, confirm that the bureau's recruiting operation uses both PeopleSoft and AWS GovCloud — matching the group's described attack path. The FBI itself said the "point of breach" is undetermined: it could be a third-party provider's system or the bureau's own enterprise. That ambiguity is worth sitting with. The federal government's largest law-enforcement agency, days into an investigation of a breach it has now confirmed three times, cannot yet say whether the hole was in its own walls or in a contractor's.

For the thousands of Americans whose information may be in the stolen files — agents, retirees, and ordinary people who once filled out a job application — that uncertainty is the least of it. Names, home addresses, Social Security numbers, and family details in the hands of an extortion crew is the textbook setup for targeted phishing, harassment, and identity theft. The FBI has not said whether it is notifying affected individuals. For an agency that lectures the public about cyber hygiene, the silence is deafening.

The deadline clock is ticking. ShinyHunters gave the FBI one week from September 22 to correct or remove its May PSA, and has declined to say whether it will release the stolen data if the bureau doesn't comply. This is a developing story — and the next move belongs to whichever side blinks first.

The deadline this week

ShinyHunters has now raised the stakes: the group claims to hold roughly 60,000 current and former FBI staff files and has set a five-day deadline to publish the full dataset — a claim that remains unverified (The Brief, ~Sept 25). On its leak site, the group's "Final Statement" says it will "no longer answer press questions" on the matter and claims it is "highly confident we have achieved our goal" (Cybernews, Sept 24–25).

The original seven-day demand, per Cybernews and Hackread, was that the FBI "correct or simply REMOVE the 2026 Quarter 2 FLASH report" — Alert I-051526-PSA, dated May 15, 2026, titled "ShinyHunters: Cyber Criminal Group Attacks Learning Management System" — putting the deadline around September 29–30, i.e. this week. Privacy and cybercrime lawyer Miriam Wugmeister told AP (via TechXplore, Sept 24) there was "reason to believe the hackers' claims," saying it was likely they had compromised the website and obtained data — a national-security alarm for agents' families. The FBI's own PSA, which ShinyHunters disputes, characterizes the crew as using "real or exaggerated claims of access to sensitive or personal information to prompt payment" and as people who "harass or threaten victims" (FBI IC3 alert, via AP). The open question now: does the bureau comply, or does the data dump?

Related: One Cop's Credentials on a Personal Device: How ShinyHunters Raided Florida's DAVID Database — the same crew's last major heist.

Sources: FBI National Press Office (Sept. 23, 2026 statement, via fbi.gov); The Associated Press (Sept. 23, 2026, reporting by Eric Tucker, via the Las Vegas Review-Journal); The Register (Sept. 25, 2026 — the ShinyHunters spokesperson interview and Friday FBI confirmation); Hackread (Sept. 22, 2026 — the defacement observation); SecureWorld (Sept. 24, 2026 — the 404 Media sample, Reuters and NBC News verifications, Axios data-content detail, CVE-2026-35273 history, the one-week deadline); ASIS/Security Management (Sept. 24, 2026 — the May PSA background, the Kaiser and O'Neil quotes, the non-monetary motive); NewsNation via Nexstar (Sept. 27, 2026 — weekend FBI confirmation); Fox News Digital (via the New York Times Post — Jason Pack's "keys to the kingdom" analysis).