ShinyHunters Taunts FBI With Claimed 3TB Data Theft Of Agent Records

by Aaron Leong — Wednesday, September 23, 2026, 11:02 AM EDT

FBI career and HR servers were breached and up to 3 TB of employee data stolen - Image: David Trinks via Unsplash

A notorious extortion group claims to have pulled off one of the most audacious cyberattacks in recent memory by allegedly breaching the Federal Bureau of Investigation and stealing about 3TB worth of records belonging to thousands of current and former employees.

The hacking collective, known as ShinyHunters (the same group that was recently linked to a Spectrum data breach), announced on its dark web leak site that it gained access to multiple bureau services, including recruitment portals, human resources infrastructure, and criminal justice databases. The group asserted that it managed to extract between 2-3TB of sensitive data covering nearly every FBI agent, as well as everyday individuals who submitted employment applications to the agency.

To back its claims, the syndicate provided 404 Media a sample file containing PIIs for approximately 5,000 personnel, detailing full names, home addresses, phone numbers, dates of birth, SSNs, and records concerning employees' spouses. The site was able to verify a portion of the leaked dataset and confirmed matching details for current bureau staff, including high-ranking leadership.

ShinyHunters stated that its intrusion was executed using an unpatched zero-day vulnerability in Oracle’s PeopleSoft enterprise software, granting them remote code execution capabilities on the bureau's career network servers. After gaining entry, the hackers reportedly pivoted into AWS GovCloud cloud-hosted environments to pull down mass storage archives. Just to show off, ShinyHunters replaced the FBI’s primary recruitment homepage with a message that read "this site has been seized by ShinyHunters." The portal, alongside the Special Agent Applicant Portal, was subsequently taken offline, with visitors encountering automated maintenance notices as IT teams worked on the issue.

ShinyHunters replaced the FBI's recruitment homepage with this humble message - Image: ShinyHunters

Interestingly, the extortionists, who have previously targeted major organizations, claim that the breach was not driven by financial motives, but rather as a retaliation against a public warning issued by federal law enforcement earlier in the year. That official advisory accused the crew of employing harassment tactics, false claims, and extortion against corporate and educational targets. Dismissing those characterizations as deliberate disinformation meant to harm their reputation, the hackers issued a one-week ultimatum demanding that the government publicly retract or remove the alert.

The FBI confirmed that the agency is aware of claims surrounding unauthorized activity affecting its career sites and has launched an investigation into the scope of the incident. While officials have not yet validated the full extent of the compromised internal networks, the potential fallout poses severe personal safety and counterintelligence risks.