ShinyHunters Says It Stole FBI Personnel Files
ShinyHunters claimed a jobs-portal breach holding FBI employee and applicant records. The bureau says it is investigating. Here is what the reporting actually shows.
TL;DR
- —On September 22, 2026, ShinyHunters said it had defaced FBIJobs.gov and taken personnel data.
- —Reported fields include names, home addresses, phone numbers, Social Security numbers, and job assignments.
- —The FBI has confirmed it is investigating a claimed compromise of the jobs portal. The full scope is still the bureau's to prove.
What was claimed On September 22, 2026, ShinyHunters said it had defaced FBIJobs.gov with a seizure-style banner and taken data on bureau employees and applicants. The group was not asking for money. Reporting describes a demand that the FBI retract a public warning about the group's habit of harassing victims and their families. Nextgov reported that a sample circulating the next day contained roughly 5,000 entries with names, home addresses, phone numbers, and details about spouses and siblings. Some entries pointed at intelligence and surveillance roles, including a person listed in the FISA Management Unit. The New York Times later reported that an internal memo said the bureau believed the theft may cover sensitive information on all of its employees, and that a review of records found home addresses, Social Security numbers, and secretive job assignments. What is confirmed The FBI has said it is aware of a criminal group claiming a compromise of the FBIJobs.gov portal and an impact on employee personally identifiable information, and that it is investigating. That is a confirmation of the claim and the investigation, not a confirmation of every number the hackers published. Comparisons to the Office of Personnel Management breach are analogies from commentators, not a finding that the same volume of records moved. "All employees" is the bureau's fear as reported by the Times, and the group's boast. It is not yet a published victim count. Why a jobs portal is enough A careers site is a poor place to keep the home address of someone who works electronic surveillance. Applicants hand over the data because the form asks. Employees stay in the file because offboarding is an afterthought. Neither group was asked whether that portal should be a second personnel system. The useful question is not whether the group is stylish. It is which fields a public jobs site is allowed to store, how long they live there, and who can export them. A seizure banner is theater. An unencrypted export of home addresses is the receipt.