The United States Federal Bureau of Investigation has confirmed it is actively investigating claims by a criminal hacking group that it broke into the bureau's jobs website and stole highly sensitive personal data on thousands of current and former employees. "The FBI is aware of a cybercriminal enterprise group claiming a compromise of the fbijobs.gov portal and alleged impact to FBI employee personally identifiable information," the agency said in a statement Wednesday, adding that it is working with third-party providers to mitigate risk while the precise point of breach remains undetermined.
The group behind the claim, ShinyHunters, says it exploited a zero-day vulnerability in Oracle PeopleSoft — software used to manage human resources and financial data — and extracted between two and three terabytes of information. A data sample shared with media outlets reportedly contained identifying details on roughly 5,000 employees, including home addresses, phone numbers, spouses' names, and some medical information. Journalists and researchers were able to verify portions of the sample against publicly available records and earlier leaks, lending credibility to the claim, though the full scope of the breach has not been confirmed. According to Reuters, the data also includes granular detail about agents' assignments, encompassing sensitive work targeting Chinese espionage, Russian intelligence operations, and drug cartels. FBI officials sent an internal memo to staff Tuesday warning them of the claims and urging them to take steps to protect their personal information. The bureau employs approximately 37,000 people.
ShinyHunters framed the attack as retaliation. In May, the FBI published an advisory characterising the group as "threat actors" who steal large quantities of data and extort victims, sometimes with false or exaggerated claims. The hackers have given the bureau one week to retract or amend that advisory, saying they feel defamed by the description. They denied that financial gain is their motive and said they are attempting to prevent the data from circulating widely in the meantime. The jobs portal remained offline as of Wednesday afternoon, having displayed a message Tuesday stating the site had been "seized" by the group.
The incident is the latest in a series of cybersecurity breaches affecting the bureau. In March, the FBI disclosed it was investigating suspicious activity on an internal system related to surveillance operations. That same month, a pro-Iranian hacking group claimed to have accessed the personal email account of FBI Director Kash Patel, posting photographs and personal documents online. Earlier reporting also revealed that Chinese hackers had previously been found inside a database linked to domestic surveillance warrants.
Security experts and former officials warn that the potential consequences of this latest alleged breach go well beyond the exposure of personal details. Home addresses, family connections, and phone numbers could be used to identify, track, or pressure FBI agents — particularly those working undercover or on counterintelligence operations. Former FBI official Cynthia Kaiser noted that the most alarming scenario would be criminal actors or foreign intelligence services using the data to physically target agents or their families. If the stolen information reaches hostile state actors, analysts say it could effectively serve as a roadmap for espionage or retaliation against bureau personnel.