A notorious cybercriminal group claims it breached the FBI on Monday and stole data about personnel and job applicants.
The group, which calls itself ShinyHunters, claimed in communications posted on the dark web and exchanges with multiple media outlets that it stole 2 to 3 terabytes of data related to FBI and Justice Department workers. The hackers claim to have used a new vulnerability with Oracle PeopleSoft, a human resources management program.
RansomLook, an open-source ransomware intelligence archive that monitors data leak sites, has captured and archived two statements posted under the ShinyHunters identity concerning the group’s claimed FBI breach.
On Tuesday, ShinyHunters claimed in a post that was addressed to FBI Director Kash Patel and FBI Cyber Division Assistant Director Brett Leatherman: “We have compromised the FBI.”
The cybercriminals said they possessed sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs. It listed criminal justice, human resources and Medlink systems among the services that were affected.
On Tuesday, the home page for FBI careers had a “System Unavailable” message at the top of the page. It read, “Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable. For urgent scheduling issues, please reach out to your Applicant Coordinator. We apologize for the inconvenience.”
The FBI has not confirmed the breach, but said Tuesday it was aware “of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”
On Wednesday, the agency offered a more detailed statement: “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII). While the point of breach is still undetermined — whether a third party or the FBI’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.”
Reuters and 404 Media reported that portions of data supplied by the hackers to those media outlets correspond to real FBI or Justice Department personnel, though neither has established that the records came from FBI systems. CBS News has not independently verified these findings.
FBI documents confirm that the agency’s recruiting arm uses PeopleSoft and AWS GovCloud. The new software vulnerability, breach of the FBI’s systems and large-scale data theft are plausible, though ShinyHunters’ claims have not yet been verified by CBS News.
In the group’s post, which was saved by RansomLook, ShinyHunters complained about an FBI FLASH report issued during the second quarter of 2026 and disputed the bureau’s characterization of the group and its tactics. The group said the FBI had suggested that ShinyHunters sometimes exaggerates access, harasses victims or relatives, participates in swatting and falsely claims to possess compromising material. The group also took issue with the FBI’s description of ShinyHunters, denying that its demands are financially motivated and rejecting descriptions of their actions as ransom, coercion or extortion.
In May 2026, the FBI issued two warnings related to ShinyHunters-linked activity. A May 8 FLASH bulletin described what it called the group’s ecosystem — warning of stolen credentials, abuse of trusted vendor and cloud relationships, plus data theft and extortion sometimes involving harassment.
A week later, an Internet Crime Complaint Center (IC3) advisory cautioned that actors using the ShinyHunters name may make real or exaggerated claims of access, threaten victims and relatives, engage in swatting and falsely allege they hold compromising material in order to pressure targets.
In both warnings, the FBI advised organizations not to pay or engage with their demands.
The group gave the FBI a deadline of one week to “correct or remove” portions of the earlier FLASH report.
Earlier this year, from May 25 through June 9, Google also documented ShinyHunters exploiting a different Oracle PeopleSoft zero-day vulnerability.
CBS News has reached out to Oracle for comment.
ShinyHunters is a cyber extortion group that has been active since at least 2020. While it is widely known for executing large-scale data and cloud theft, security researchers treat it not as one single, fixed entity, but rather as a shifting ecosystem of threat actors.
This is at least the third potentially major cyber incident to impact the FBI or its employees so far this year.
In March, the FBI revealed it had detected suspicious cyber activity targeting one of its systems. That system stores unclassified and law enforcement sensitive information, such as pen registers — which are surveillance tools that record phone numbers, IP addresses, signaling and other information, in real time — and trap-and-trace surveillance returns, as well as personally identifiable information related to subjects of FBI criminal probes.
Later that same month, Patel’s personal email account was targeted by hackers linked to Iran.
