Hackers Say They Stole FBI Job Site Data. Here's What We Know

ShinyHunters says it holds 2-3TB of private information about FBI workers and job applicants after an alleged break-in at FBIJobs.gov. The job site was offline on Wednesday, September 23, 2026, as the claims spread. The FBI says it knows about the claim and is actively and aggressively investigating it Engadget.

The group says it got in through a security hole no one knew about in Oracle's PeopleSoft, software used to manage hiring, to reach Amazon's special cloud system for government work, known as GovCloud. Think of it like a back door no one knew was there. A ShinyHunters spokesperson told 404 Media: "We hacked the FBI. We hold data on all FBI employees and applicants." 404 Media said it received confirmation from the group, while Reuters reported it had seen a sample of the alleged data.

That sample, as described in reporting, had names, addresses, phone numbers, birth dates, Social Security numbers and emergency contact details for 5,000 FBI workers. The alleged theft may also include job assignments for agents and details about FBI teams that handle intelligence, security and counter-espionage work, including operations focused on China and Russia.

The FBI used careful language. It said it was aware of a cyber-criminal group claiming a break-in at the FBIJobs.gov site with alleged impact to worker personal details. The scope is unconfirmed. Nextgov reported that the full scope remains unclear, and the Bureau has described its work as a check into a claimed break-in rather than a confirmed breach.

The group said the attack was not about money but to push the FBI to take back or change an earlier statement about ShinyHunters. That statement came in a May report in which the FBI said ShinyHunters overstated claims of access to private or personal information to get victims to pay. Reuters described ShinyHunters as a digital extortion group, a group that threatens to release stolen data unless demands are met.

Reuters reported on September 22, 2026 that ShinyHunters said it had broken into the FBI and stolen data. Politico reported the same day that the FBI said it was looking into a suspected hack after the claim. BleepingComputer published a report titled "ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach" about the claimed incident.

This was not the only recent claim. ShinyHunters claims to have broken into DAVID, an online system for the Florida Department of Motor Vehicles database, a claim reported on September 8, 2026. The group has also claimed responsibility for a recently reported Ernst and Young data breach, reported on July 27, 2026. Separately, the FBI seized a BreachForums web address used by ShinyHunters as a site to leak stolen data from widespread Salesforce attacks, an action reported on October 10, 2025.

The broader picture here is more important than the large size number. Job sites collect details that are hard to replace, such as identity papers, work history and contact lists for applicants. That information stays sensitive even after hiring ends. If the claimed path is correct, the hiring software sat close to private internal work records. That closeness is risky for any group that runs hiring systems connected to other computer systems.

In my view, it is best to look at the size claim and the sample separately. A sample can be checked for errors, format and matches with known older leaks without accepting the 2-3TB total as true. Attack groups have reasons to inflate numbers, as the FBI noted in May, and defenders have reasons to prepare for the worst. Both can be true. The useful work now is changing passwords and login details for exposed staff, watching for misuse of emergency contacts, and checking the walls between public job sites and private internal systems.

Looking ahead, what this case could improve is simple and useful. Stronger separation between job applicant systems and internal work records, faster fixes for hiring software, and shorter storage times for applicant data would make the next claim, true or inflated, less harmful. Those steps will not make job systems perfect. They can make them less appealing to attack.