The FBI has instructed its employees to operate under the assumption that the hacker group ShinyHunters has stolen personal information belonging to every staff member, according to an internal memo.
The warning follows an incident involving FBIjobs.gov, where the cybercrime crew claims to have acquired between 2 and 3 terabytes of data. According to the hackers, the stolen haul includes information on nearly all FBI agents, job applicants, and some spouses, including names, phone numbers, and home addresses. The FBI has stated it is investigating the breach, though it has not officially confirmed the scale or the intrusion method.
ShinyHunters claims the breach began on a Monday night, and visitors to the recruitment site encountered a banner stating the domain had been seized by the group by Tuesday, September 22. The hackers asserted that they gained entry using a previously unknown vulnerability—a zero-day bug—in Oracle's PeopleSoft software, although the FBI has not verified this claim.
According to the group, the action was triggered by a May 15 advisory issued by the FBI warning that ShinyHunters engages in harassment tactics, such as threats to family members and swatting. The hackers denied the allegations and issued a one-week ultimatum demanding a retraction from the bureau.
In response, FBI Cyber Division Chief Brett Leatherman published a video on X on September 29. Leatherman referenced a September 15 arrest in the Netherlands, told the hackers that the bureau knows how to find them, and urged them to reach out. ShinyHunters subsequently stated that the arrested individual had no connection to them, called their own ultimatum a marketing campaign, and stated they do not plan to publish the data.
Despite the hackers' statements, the internal memo advises bureau staff to assume their data is already exposed, watch for suspicious calls or texts, and anticipate virtual briefings. The document highlights risks including identity theft, doxxing, and potential threats to the relatives of FBI personnel.
