ShinyHunters Claims FBI Breach Exposed Agents’ and Applicants’ Data

Cybercriminal group ShinyHunters claims it breached the FBI and obtained sensitive information linked to thousands of agents and job applicants. The group made the claim on its dark web leak site, saying the stolen data includes information belonging to FBI employees and people who applied for positions at the agency.

404 Media first reported the alleged breach, saying it received a sample of the stolen data. The publication reported that the sample included names, home addresses, and phone numbers of FBI agents and their spouses, and that it checked portions of the information against public records.

Claims of a Large-Scale Data Theft

ShinyHunters said the attack was not financially motivated and demanded that the FBI remove a report that the group claims contains false allegations about its activities. The group did not explain what it would do with the stolen information if the demand were not met.

According to the reported claims, the attackers allegedly accessed an Oracle PeopleSoft server used for human resources and recruiting operations before moving into an Amazon-hosted government cloud environment containing information related to agents and applicants.

The hackers claimed they obtained terabytes of data. If the claims are confirmed, exposed personal information could create risks for affected individuals by making them potential targets for harassment, social engineering, or other forms of exploitation.

FBI Has Not Confirmed the Breach

The FBI has not publicly confirmed the alleged intrusion or said whether its systems were compromised.

The hackers also reportedly disrupted the FBI jobs website. An archived version of the portal showed the site was unavailable for maintenance at the time of reporting, including the special agent applicant portal. The Internet Archive hosts the archived page.

ShinyHunters’ claims follow the FBI’s publication of a cybersecurity advisory related to the group. The hackers said that advisory contained false allegations and referenced the FBI Internet Crime Complaint Centre notice in their demands.

Growing Risks for Government Data

The incident highlights the risks organisations face when they store sensitive employee and applicant information. Government agencies, like other large organisations, rely on complex systems that cybercriminal groups can target.

Security experts have repeatedly warned that stolen credentials and personal information can be valuable to attackers because they may enable further attempts to access systems or target individuals.