The notorious hacking group ShinyHunters claims to have broken into systems belonging to the Federal Bureau of Investigation (FBI), stealing sensitive personal data on thousands of current, former, and prospective employees. The group made the announcement on Tuesday, September 22, posting a statement to its dark-web site and communicating directly with Reuters. The FBI confirmed in a statement that it "is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."

ShinyHunters said it had obtained data on "almost ALL FBI Agents, and individuals who filed an application with the FBI for a job." As evidence, the group shared what it described as a screenshot of a defaced FBI job site — briefly altered to display the message "this site has been seized by ShinyHunters" — along with a sample dataset purportedly covering roughly 5,000 agents. That sample appeared to include names, home addresses, Social Security numbers, job assignments, phone numbers, and in some cases the names of agents' family members. Reuters was able to partially verify details from the sample by cross-referencing them with credit bureau records and previously leaked data, finding apparent matches in at least ten cases, including one entry corresponding to FBI Director Kash Patel. However, neither Reuters nor other outlets could conclusively establish that the data originated from the FBI's internal systems, as the hackers claimed.

The group says the breach was retaliatory. In May 2026, the FBI published guidance that detailed ShinyHunters' operational methods and advised victims of the group's extortion campaigns not to pay ransom demands. ShinyHunters told Reuters it launched the attack specifically in response to that announcement.

Cybersecurity experts warn that the potential consequences are serious and long-lasting. Cynthia Kaiser, a former FBI official now serving as senior vice president at cybersecurity firm Halcyon, described such breaches as "incredibly harmful," noting that criminals can use leaked agent data to expose, harass, and apply pressure to the investigators pursuing them. She pointed to a 2016 data leak that continues to be used to harass FBI personnel to this day. "Once that information is stolen, it is used forever," she said.

ShinyHunters is considered one of the world's most active and prominent cybercrime groups. Recent operations attributed to the group include a purported theft of business records from Rockstar Games, maker of the Grand Theft Auto franchise, and a May intrusion targeting the educational platform Canvas that caused widespread disruption in schools across the United States. AI company Anthropic also disclosed earlier this month that it had detected ShinyHunters-linked hackers attempting to exploit its tools. The group is also reported to have recently declared a public feud with rival cybercrime group cl0p, an unusual move even by the standards of the underground hacking world.