started · updated
FBI systems allegedly breached by ShinyHunters hackers
The cybercriminal group ShinyHunters claims to have breached FBI systems, allegedly stealing between 2TB and 3TB of sensitive data. The group asserts that the stolen information includes personal details of nearly all FBI agents, current and former employees, and job applicants, such as names, home addresses, phone numbers, and information regarding spouses.
According to the group, the intrusion was facilitated by exploiting a zero-day vulnerability in Oracle PeopleSoft, which allowed them to move into other environments, including an Amazon-hosted government cloud. The hackers also claimed to have defaced the FBI's recruitment website. The FBI's jobs site and the Special Agent Applicant Portal were reported as temporarily unavailable on Tuesday.
The group stated the attack was not financially motivated but was a retaliation for a May 2026 FBI public service announcement that detailed ShinyHunters' tactics and advised victims against paying ransoms. ShinyHunters has demanded that the FBI retract or revise this advisory within one week. While investigators and journalists have partially corroborated samples of the leaked data by matching names and addresses against credit bureau records and previous breaches, the FBI has not officially confirmed the breach or the authenticity of the stolen data.
Entities
404 Media · AWS GovCloud · Brett Leatherman · Clop · FBI · Huntress · Kash Patel · Oracle · Reuters · ShinyHunters
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] The FBI's recruitment website and Special Agent Applicant Portal were unavailable on the day of the report. www.cmjornal.pt · pplware.sapo.pt · sbtnews.sbt.com.br
- [● 10 SOURCES] The hacking group ShinyHunters claims to have breached FBI systems. www.cmjornal.pt · pplware.sapo.pt · sbtnews.sbt.com.br · thebeltwayreport.com · cyberinsider.com · +5 more
- [● 10 SOURCES] The group alleges they stole data belonging to thousands of FBI employees, agents, and applicants. www.cmjornal.pt · pplware.sapo.pt · sbtnews.sbt.com.br · thebeltwayreport.com · cyberinsider.com · +5 more
- [● 3 SOURCES] Reuters verified a partial match for names and addresses in at least nine cases from the alleged stolen data. sbtnews.sbt.com.br · ct24.ceskatelevize.cz · news.az
- [● 10 SOURCES] The attack was a response to an FBI report from May 2026 detailing the group's methods. www.cmjornal.pt · pplware.sapo.pt · sbtnews.sbt.com.br · thebeltwayreport.com · cyberinsider.com · +5 more
- [● 6 SOURCES] The group claims to have exploited a zero-day vulnerability in Oracle PeopleSoft via the apply.fbijobs.gov domain. pplware.sapo.pt · cyberinsider.com · www.it-boltwise.de · donanimgunlugu.com · www.dimokratia.gr · +1 more
- [● 5 SOURCES] The group claims to have stolen between 2TB and 3TB of data. thebeltwayreport.com · cyberinsider.com · www.dimokratia.gr · www.powergame.gr · donanimgunlugu.com
- [● 15 SOURCES] The FBI has not confirmed the breach. www.cmjornal.pt · pplware.sapo.pt · sbtnews.sbt.com.br · thebeltwayreport.com · cyberinsider.com · +10 more
- [● 8 SOURCES] The group claims to have defaced the FBI jobs website. www.cmjornal.pt · pplware.sapo.pt · thebeltwayreport.com · cyberinsider.com · itnerd.blog · +3 more
- [● 6 SOURCES] A sample of approximately 5,000 files was provided to 404 Media as evidence of the breach. www.dimokratia.gr · www.powergame.gr · pplware.sapo.pt · thebeltwayreport.com · yournews.com · +1 more
- [● 11 SOURCES] The FBI has not yet confirmed if the data originated from its internal systems. www.lamiareport.gr · www.cnbce.com · www.dimokratia.gr · www.powergame.gr · pplware.sapo.pt · +6 more
- [● 13 SOURCES] The attack is a retaliation for an FBI announcement in May 2026 regarding the group's methods. www.lamiareport.gr · www.cnbce.com · www.dimokratia.gr · www.powergame.gr · www.cmjornal.pt · +8 more