Hackers claim mass FBI data theft

What's happened

A hacking group calling itself ShinyHunters has claimed it has stolen two to three terabytes of FBI-related data, including a 5,000-line sample with names, addresses, phone numbers, Social Security numbers and assignment details for thousands of current and former FBI employees. The FBI has said it is aware of the claims, has taken the jobs portal offline and has opened an active investigation.

What's behind the headline?

What happened and why it matters

ShinyHunters has posted a message claiming it seized two to three terabytes of FBI-related data and defaced the FBIJobs.gov site. Sample records reviewed by multiple outlets include names, contact details, Social Security numbers and job-assignment information that would expose operational roles. If accurate, the leak will increase personal risk to agents, endanger investigations and hand foreign intelligence services and criminal gangs a usable map of bureau staffing.

How the attack appears to have worked

• The group says it exploited a zero-day in Oracle PeopleSoft, a common HR platform, then accessed data stored in a government cloud. Multiple outlets report investigators are still determining the point of compromise.
• Reported samples include a 5,000-line spreadsheet and fragments from systems that could include HR, medical and background-check services.

Immediate consequences

• The FBI has taken the jobs portal offline and has told staff to take protective steps while investigators and third-party providers probe the incident.
• The hackers are publicly demanding the FBI remove or amend a May advisory about ShinyHunters; the group claims the advisory falsely accused it of extortion and harassment.

Likely next steps and risks

• The FBI will escalate the investigation and will work with cloud and PeopleSoft vendors; Oracle and affected providers will face urgent forensic scrutiny.
• The stolen data will likely be copied and traded; this will increase risks of doxxing, targeted harassment, extortion, identity theft and counterintelligence exploitation.
• Even if the FBI contains the breach technically, the reputational and operational fallout will persist: exposed agents and their families will require protective measures, and the bureau will likely alter access controls and third-party risk policies.

Bottom line

This will force agencies and vendors that rely on shared HR and cloud services to re-evaluate security controls and zero-day exposure plans. The core danger is not the initial defacement but the scale and sensitivity of the personnel data the hackers claim to hold.

How we got here

ShinyHunters has publicly claimed recent breaches of major services and posted samples to prove intrusions. Media outlets have reviewed small samples and partially verified some records. The hackers have demanded the FBI retract a May advisory that described the group as a threat actor; the FBI has not confirmed the breach's cause or scope.

Our analysis

The coverage converges on three core claims: ShinyHunters says it stole terabytes of FBI personnel data; multiple outlets have seen and partially verified samples; and the FBI has said it is investigating while the jobs portal remains offline. The Japan Times reports that the 5,000-line spreadsheet contains names, addresses, dates of birth, Social Security numbers and assignment details, noting some entries point to units doing counterintelligence and counterespionage work. Ars Technica and Axios both cite the group's claim of a PeopleSoft zero-day and note the group denies financial motive; Ars quotes ShinyHunters saying it has "weaponized a zero-day" in Oracle PeopleSoft. BBC Business and Reuters (reported via BBC) say the group claims records for roughly 38,000 staff and applicants and that samples show sensitive job-assignment details; the BBC quotes a cybersecurity expert, William Wright, calling the strike a "retaliation attack" intended to control narrative. Politico and Reuters emphasise the counterintelligence implications: Politico quotes an anonymous source calling the situation "really bad" and notes investigators view the claims as credible. AP, CNBC and the New York Post report the group's demand that the FBI retract a May advisory that labelled ShinyHunters as threat actors; AP and CNBC reproduce the advisory's language that the group "commonly use harassment strategies" while ShinyHunters says that characterization is false. TechCrunch and Bloomberg provide technical context: TechCrunch reports the hackers claim to have pivoted from a PeopleSoft server into cloud storage and notes previous high-profile intrusions; Bloomberg documents the claim about terabytes of data being offered. Across sources, verification is partial: Reuters and other outlets have confirmed portions of sample records against public and credit-bureau data in a limited number of cases, but none of the reporting stands as a full forensic confirmation that FBI internal systems were breached. The consistent thread is caution: the

Go deeper

• How will the FBI protect agents and their families if the stolen data is real?
• What will Oracle and PeopleSoft providers disclose about a possible zero-day?
• Could foreign intelligence services exploit the leaked assignment details?

More on these topics

• United States - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.

• Federal Bureau of Investigation - Law enforcement agency

  The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency.

• TechCrunch

  TechCrunch is an American online publisher focusing on the tech industry. The company specifically reports on the business related to tech, technology news, analysis of emerging trends in tech, and profiling of new tech businesses and products.

• Peoplesoft - Company

  PeopleSoft, Inc. was a company that provided human resource management systems, Financial Management Solutions, supply chain management, customer relationship management, and enterprise performance management software, as well as software for manufacturin

• Kash Patel - Director of the Federal Bureau of Investigation

  Kashyap Pramod Patel (born February 25, 1980) is an American lawyer serving since 2025 as the director of the Federal Bureau of Investigation. Patel also served as acting director of the Bureau of Alcohol, Tobacco, Firearms and Explosives from February...

• Brian Krebs - American journalist

  Brian Krebs is an American journalist and investigative reporter. He is best known for his coverage of profit-seeking cybercriminals. His interest grew after a computer worm locked him out of his own computer in 2001. Krebs is the author of a daily blog,

• Russia - Country

  Russia, or the Russian Federation, is a transcontinental country located in Eastern Europe and Northern Asia. Covering an area of 17,125,200 square kilometres, it is the largest country in the world by area, spanning more than one-eighth of the Earth's in

• People's Republic of China - Country in East Asia

  China, officially the People's Republic of China, is a country in East Asia. It is the world's most populous country, with a population of around 1.4 billion in 2019.

• Canada - Country in North America

  Canada is a country in the northern part of North America. Its ten provinces and three territories extend from the Atlantic to the Pacific and northward into the Arctic Ocean, covering 9.98 million square kilometres, making it the world's second-largest c

• Reuters - News organization company

  Reuters is an international news organization owned by Thomson Reuters. It employs some 2,500 journalists and 600 photojournalists in about 200 locations worldwide. The agency was established in London in 1851 by the German-born Paul Reuter.

• Louisiana - US State

  Louisiana is a state in the Deep South region of the South Central United States. It is the 19th-smallest by area and the 25th most populous of the 50 U.S. states.

• Washington, D.C. - Capital of the United States of America

  Washington, D.C., formally the District of Columbia and commonly referred to as Washington or D.C., is the capital of the United States.

• Iran (Islamic Republic of Iran) - Country in the Middle East

  Iran, also called Persia, and officially the Islamic Republic of Iran, is a country in Western Asia. It is bordered to the northwest by Armenia and Azerbaijan, to the north by the Caspian Sea, to the northeast by Turkmenistan, to the east by Afghanistan a

• Pete Hegseth - United States Secretary of War

  Peter Brian Hegseth (born June 6, 1980) is an American government official and former television personality who has served since 2025 as the 29th United States secretary of defense. Hegseth studied politics at Princeton University, where he was the publi

• New York Post - Newspaper

  The New York Post is a daily newspaper in New York City. The Post also operates NYPost.com, the celebrity gossip site PageSix.com and the entertainment site Decider.com. The modern version of the paper is published in tabloid format.