Portal intrusion and defacement

On 22 September 2026, the cybercrime group ShinyHunters announced that it had breached FBIJobs.gov, the official web portal used by the Federal Bureau of Investigation for career postings and candidate submissions. The collective claimed to have exfiltrated between two and three terabytes of data, a volume representing millions of document pages. Before the site was taken offline, the homepage displayed a defacement message stating that the portal had been seized by ShinyHunters. Technology outlet 404 Media first reported the breach after receiving a 5,000-line sample of the stolen records. The portal remained offline on Wednesday afternoon with maintenance notices.

Compromised personnel and intelligence records

The 5,000-line sample includes full names, residential addresses, telephone numbers, dates of birth, Social Security numbers, spouse details, emergency contacts, and selected medical information. The records also outline specific operational assignments and field office postings, including files covering personnel in units focused on counterespionage against Russian intelligence and Chinese spies, as well as teams investigating drug cartels. A workforce of nearly 37,000 FBI employees could face exposure alongside thousands of job applicants if the full cache is authentic. Independent verification confirmed details for more than 22 individuals by cross-referencing the leaked entries with credit records and dark web intelligence from District 4 Labs.

Retaliation and one-week ultimatum

ShinyHunters addressed their message directly to FBI Director Kash Patel and Brett Leatherman, the assistant director overseeing the bureau's cyber division. The hackers established a seven-day deadline for the agency to correct or delete a public warning published in May 2026. That second-quarter flash report described ShinyHunters as an extortion group known for pressuring targets and conducting swatting campaigns. The collective stated that the attack was not financially motivated, denying ransom demands and claiming the intrusion was retaliation for false allegations. The group also denied ties to The Com, an international cybercrime network, while identifying themselves as defenders of the US Constitution.

ShinyHunters posted a public message demanding the retraction of the warning:

“We have breached the FBI. We have highly sensitive data on almost ALL FBI agents and individuals who applied for a job at the FBI.”

Federal inquiry and group history

The FBI confirmed on 23 September 2026 that it is actively investigating unauthorized activity linked to FBIJobs.gov and the alleged exposure of employee personally identifiable information. Federal officials stated that the entry point remains undetermined, with investigators assessing whether the compromise occurred within the FBI network or through external contractors. ShinyHunters stated on Wednesday that it was attempting to restrict broader circulation of the personnel files during the ultimatum period. According to US Department of Justice records, the collective emerged in 2020 and previously sold data from over 60 companies on dark web forums, alongside intrusions involving 500 million Ticketmaster records in 2024, the Canvas learning platform in May 2026, video game developer Rockstar, and the European Commission.

“While the point of the breach is still undetermined, whether a third party or the FBI network, we are actively and aggressively investigating this matter, and working closely with those external vendors who support FBIJobs.gov to mitigate any and all risk.”