ShinyHunters claims it stole 2 terabytes of sensitive data from the FBI’s job application website, exposing the personal details of thousands of agents and applicants. The hacking group posted the claim on its dark-web site, asserting access to "very sensitive data" including names, agent status, home addresses, and in some cases, spouses' Social Security numbers. The FBI confirmed it is investigating unauthorized activity on FBIjobs.gov, which remained offline on Tuesday afternoon.
Cybersecurity researchers told Axios the attack appeared legitimate, though they could not independently verify if the data was current. 404 Media obtained a sample that seemed to contain records for about 5,000 people identified as FBI agents. The group alleged it exploited a zero-day vulnerability in Oracle’s PeopleSoft platform to breach the system and deface the site.
The motive, according to ShinyHunters, was not financial. They demanded the FBI retract or revise specific statements the bureau had made about its activities. The FBI had previously warned in May that ShinyHunters uses harassment tactics, including threats and swatting, against victims and their families. The hackers disputed this characterization, blaming other "low-skilled threat actors" for using their name.
The breach poses a significant long-term risk. Allan Liska, a threat intelligence analyst at Recorded Future, told Axios the data is likely to be repeatedly downloaded and shared with other threat actors. Andrew Brandt, principal threat intelligence incident commander at Huntress, warned the biggest concern is whether ShinyHunters would sell the information to criminal or state-sponsored hackers.
This incident follows a string of cyberattacks on US law enforcement. CNN reported the FBI investigated a separate suspected breach in March involving a network used for wiretaps and surveillance warrants. Last month, hackers also leaked files allegedly stolen from the Bureau of Alcohol, Tobacco, Firearms and Explosives. The FBI has not confirmed the identity of the attackers or the full extent of the compromise.