FBI Investigates Hackers’ Claim of Stolen Agent and Applicant Data

The FBI said Wednesday it is investigating a claim by the cybercrime group ShinyHunters that it broke into the bureau’s job-application systems and stole sensitive data on agents and applicants. The FBI said it “is aware of a cybercriminal enterprise group claiming a compromise of the fbijobs.gov portal,” according to Al Jazeera, and said the point of breach remains undetermined, whether a third-party provider or its own enterprise systems, CBS News and Al Jazeera reported.

The group said it carried out the breach on Monday and stole 2 to 3 terabytes of data on FBI and Justice Department workers, including personnel and job applicants, CBS News reported. It said it used a new vulnerability in Oracle PeopleSoft, a human-resources program, and claimed to hold sensitive information on nearly all FBI agents and on people who applied for bureau jobs. On Tuesday it posted a message to FBI Director Kash Patel and Cyber Division Assistant Director Brett Leatherman: “We have compromised the FBI.”

Neither outlet has verified the claim. CBS News reported that Reuters and 404 Media said some leaked data matches real FBI or Justice Department personnel, but that neither confirmed it came from FBI systems. Al Jazeera, citing Reuters, said the data includes detailed information on scores of bureau officials’ job assignments, including work against Chinese spies, Russian intelligence and drug cartels. FBI documents show its recruiting arm uses PeopleSoft and AWS GovCloud, CBS News noted.

The group’s stated aim is not a conventional ransom. It rejects descriptions of its actions as extortion and denies the demands are financially motivated, CBS News reported; it gave the FBI one week to correct or remove parts of a second-quarter 2026 FLASH report that described the group. Al Jazeera said it is holding the data hostage until the bureau rescinds a critical statement it issued in May, and that on Wednesday the group said it was trying to keep the personnel information from circulating widely in the meantime.

The bureau has been warning about the group. A May 8 FLASH bulletin and a later advisory from its Internet Crime Complaint Center cautioned about ShinyHunters-linked activity, including stolen credentials, vendor abuse, data theft and harassment, and urged organizations not to pay or engage with the group, CBS News reported. The FBI said then that such actors “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist,” Al Jazeera reported.

The FBI’s career website showed a “System Unavailable” message on Tuesday, CBS News said, and the jobs portal was still offline Wednesday afternoon, according to Al Jazeera. The bureau said it is “investigating aggressively” and working with third-party providers that support the site to reduce risk.

It is not the first reported incident this year. In March the FBI disclosed it was investigating suspicious activity on an internal system that holds sensitive surveillance and investigation information, and Iran-linked hackers claimed to have breached an account belonging to Mr. Patel and posted years-old photos and documents, both outlets reported. CBS News added that Google documented ShinyHunters exploiting a different PeopleSoft flaw from May 25 to June 9. Oracle has been contacted for comment, the network said.