The FBI declared a cyber incident after hackers claimed to steal agents’ personal data

The FBI has told its own staff it is dealing with a “cyber security incident,” according to reporting that surfaced on September 28, after the hacking group ShinyHunters claimed it had stolen personal data on agents and job applicants. The group says it holds “data on mostly all of FBI.” The bureau has not confirmed that anything was taken, and the claims remain unverified.

The internal declaration was described by TechCrunch’s Zack Whittaker, who cited reporting by MS NOW’s Ken Dilanian. The FBI declined to comment on that account. Its earlier public line had been narrower: the theft of data was “still undetermined.” The FBI has not published any notice of its own about the incident, so the declaration itself rests on that secondhand reporting.

What ShinyHunters says it took

The group’s first claims landed the week of September 21, when FBIJobs.gov began showing a “System Unavailable” message. CBS News reported that the hackers claimed 2 to 3 terabytes of data and addressed a message to FBI Director Kash Patel and Cyber Division Assistant Director Brett Leatherman, claiming a compromise of the bureau. The FBI’s own response, quoted by CBS, was that it was “aware of claims regarding unauthorized activity affecting FBIjobs.gov” and that “the point of breach is still undetermined.” CBS said it had not independently verified the claims, while noting that Reuters and 404 Media reported that samples matched real FBI or Justice Department personnel records without establishing that the records came from FBI systems.

According to TechCrunch, the material the group describes includes names, addresses, job titles, Social Security numbers and sensitive medical records such as blood and urine samples and psychiatric reports. Nextgov described a text file offered as proof that allegedly covered nearly 5,000 FBI employees, with home addresses, phone numbers and details about spouses and siblings. The full dataset has not been independently checked. The group also named FBI human resources systems and a service called Medlink among its targets, and Help Net Security lists further systems in the claims, including background-check, medical-records and investigative-information platforms and servers in Amazon Web Services GovCloud. None of those claims has been confirmed by the bureau.

A PeopleSoft flaw and a portal that stayed dark

The entry point, ShinyHunters says, was a vulnerability in Oracle PeopleSoft, the human-resources software behind the FBIJobs.gov application portal that TechCrunch says has served as the bureau’s main job application system since 2017. Google Cloud’s threat intelligence team published a report on September 25 describing a mass-exploitation campaign against unpatched PeopleSoft servers, tracked as CVE-2026-35273. Oracle issued a patch on June 10, but many organizations relied on web application firewall rules. The attacker bypassed them, Google wrote, “by URL-encoding a single character in the request path.”

Google’s report does not name the FBI. It lists dozens of affected systems across higher education, technology, healthcare, transportation and government. Help Net Security reported on September 28 that both apply.fbijobs.gov and the special-agent applicant page were still offline. The FBI has not said which of its own systems, if any, were reached, and its public statement leaves open whether the point of breach was a third party or the bureau’s enterprise network.

A hacking crew with a grievance against the FBI

Money does not appear to be the stated goal. Per TechCrunch, the group demanded a correction of an earlier FBI report rather than a ransom, and Nextgov reports the target is a May 15 public service announcement. In that FBI alert, the bureau wrote that ShinyHunters actors “commonly use harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting,” and that they use “real or exaggerated claims of access to sensitive or personal information to prompt payment.” The bureau’s advice to victims was blunt: “Do not send payment or respond to their demands.”

The May alert now frames how the current claims should be read. Exaggeration is part of the group’s documented playbook, which is one reason the verified facts are thin even as the sample records circulate. Yet the consequences of even partial exposure are serious. Justin Sherman of Lawfare, quoted by TechCrunch, called the episode a “counterintelligence disaster,” because personal details on agents could feed profiling, phishing and foreign intelligence targeting.

The kinds of records named in the claims matter for who could be affected. Blood and urine samples and psychiatric reports are the sort of material collected during medical and suitability screening, which suggests applicants who advanced through the hiring process, not only serving employees, could appear in any dataset. That inference is not confirmed by the FBI. Because the portal has been the bureau’s primary application channel since 2017, the pool of people who could be affected reaches back nearly a decade.

For applicants, the practical question is whether they were among the records taken, and no official count exists. Whether the FBI will notify Congress or those affected remains unclear in the reporting so far, and Nextgov reports that ShinyHunters gave the bureau one week to retract its warning.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview