Hackers Say They Stole Personal Info of FBI Agents and Job Applicants
A group of hackers called ShinyHunters says it broke into the FBI and stole personal information for thousands of agents and job applicants. The group made the claim on September 22, 2026.
The claim was posted on ShinyHunters' dark web leak site, which TechCrunch reviewed. In that post the group claimed to have stolen "sensitive data on almost all FBI agents and individuals who filed an application with the FBI for a job" TechCrunch. Reuters also reported on September 22, 2026 that the group known as ShinyHunters says it breached the FBI Reuters.
404 Media first reported the claimed breach after getting a sample of the stolen material. The sample had names, home addresses, and phone numbers of FBI agents and their spouses, and 404 Media checked part of it against public records. That sample covered 5,000 alleged agents 404 Media.
According to 404 Media reporting cited by TechCrunch, the hackers first broke into an Oracle PeopleSoft server, software used to manage employee records, and then moved into a government cloud system run on Amazon that stored agent and applicant data TechCrunch. It was like breaking into a side office to steal the keys to the main file room.
The public disruption hit FBI hiring. The hackers reportedly defaced the FBI jobs site apply.fbijobs.gov, including the special agent applicant portal. On September 22, 2026 the site showed "currently down for maintenance."
ShinyHunters said the FBI hack was "not financially motivated" and demanded the FBI remove an IC3 report it says contains false allegations about the group. The group told 404 Media it took terabytes of FBI data and did not say what it would do with the information if the FBI does not take down its published report.
The report at issue is PSA260515, titled "ShinyHunters: Cyber Criminal Group Attacks Learning Management System" IC3. It was published on May 15, 2026. Separately, the FBI had warned organizations about a campaign by cybercriminal groups including Scattered Spider and ShinyHunters to compromise Salesforce platforms, in a notice published September 15, 2025.
TechCrunch described the claimed ShinyHunters incident as the second known breach of an FBI system in 2026, after hackers broke into a system for managing real-time wiretaps and foreign intelligence-gathering warrants.
The broader context here is simple. When employee systems are connected to storage holding personal records, one break-in can lead to a much larger theft. Applicant data makes this worse, because it includes people who never became employees and never got internal security training or monitoring.
In my view, checking what was really taken comes next. A sample check shows the claim is believable, not that the full size is proven. That takes a review of software logs, login records, cloud records, and how much data left, compared to the terabytes claimed. The practical fix is plain. Lock down links between older office software and cloud storage, delete old applicant data sooner, and expect public claims to force quick notice decisions before an investigation ends. That will not stop every attack, but it keeps one break-in from taking as much.
