Saying they will not publish the files is not the same as the files being gone. On September 22, 2026, the FBI’s hiring site, apply.fbijobs.gov, was defaced by people using the name ShinyHunters. They told reporters they had personnel data on FBI employees and applicants. The bureau says it is investigating. A week later the group told newsrooms it never planned to dump the cache. Samples had already been handed to journalists. [1] [2] [7]
This is not the Florida driver-database break. Same name, different door. That one is here.
What was claimed, and what was checked
| The crew | What reporters could check | |
|---|---|---|
| Who | “All” FBI employees and every applicant. [1] | 404 Media saw a sample of about 5,000 records, with names, home addresses, phone numbers, and spouse details. [1] |
| How much | 2 to 3 terabytes, including HR, a criminal-justice system, and Medlink. [2] | BleepingComputer has not verified the size or the lateral move they describe. The FBI has not published a count. [2] |
| How personal | Psychiatric files, prescriptions, and health notes on agents. [3] | Reuters reviewed documents the group shared and reported psychiatric and medical files. It could not confirm the named internal systems. The Times reported home addresses, Social Security numbers, and secretive assignments, plus an internal memo that sensitive information on employees may have been taken. [3] [9] |
| The door | A new, unpatched bug in Oracle PeopleSoft, then a jump into the bureau’s Amazon government cloud. [2] | The bureau has not confirmed that path. Google’s Mandiant unit describes a known PeopleSoft flaw, CVE-2026-35273, plus a change in how the request is written so a firewall blocking only the obvious address can miss it. The group told BleepingComputer it used that dodge on the jobs site and still claims a separate unknown bug. [4] [5] |
The FBI’s public line, given to BleepingComputer on the day of the claim: it is aware of claims about unauthorized activity on FBIjobs.gov and is investigating. It did not, in that statement, confirm a breach or a theft. Reuters later reported the bureau said it was aggressively investigating and would not discuss the medical files. [2] [3]
Why they say they did it
In May 2026 the FBI put out a FLASH warning that described this crew as one that harasses victims and their families, and that leans on real or inflated claims to push for payment. The group demanded the warning be corrected or taken down within a week, and said the demand was not about money. [2]
On September 28 they told several newsrooms the opposite of a leak threat. They said they had decided at the start never to publish the FBI cache, called the week-long demand a “marketing campaign,” and said nothing would happen when the week ended. PCMag reported the original threats had been taken off their site, and that the May advisory was still up. Nextgov noted the new statement does not say the records were deleted. Samples were already with reporters. [7] [8]
Nextgov also reported the bureau emailed its own people and told them to take protective steps while investigators worked. [7]
The arrest, then the hack
Krebs on Security reported that Dutch police arrested a 24-year-old man on or around September 16 in their ShinyHunters investigation, days before the FBI claim. Krebs did not report that he is suspected of the FBI hack itself. We are not naming him: he has not been convicted of anything in this case. [6]
Dutch police confirmed on September 28 that a 24-year-old was in custody in the ShinyHunters inquiry. [6] [10] Krebs reported he was due before a Rotterdam court on September 29. Who is running the ShinyHunters name now has not been confirmed by police. [6]
The week, in order
- May 2026. FBI FLASH warning about the group’s tactics. [2]
- Around September 16. Dutch arrest in the ShinyHunters inquiry, reported by Krebs on Security. [6]
- September 22. Jobs site defaced. 404 Media and BleepingComputer get the claim and a sample. The bureau says it is investigating. [1] [2]
- September 25. Reuters reports medical and psychiatric files in what the group shared. Mandiant and Google warn that PeopleSoft attacks are spreading again. [3] [4] [5]
- September 28. The group tells reporters it will not publish. Dutch police confirm the arrest. The Times reports the internal damage assessment. [7] [6] [9]
What this means if you are in the file
Agents, staff, and people who applied for a job did not get a vote on a hiring portal that also held home addresses and medical notes. A password can be changed. An address, a spouse’s name, and a Social Security number cannot. A promise not to post the pile on a leak site does not pull copies back from whoever already has a sample.
- Trust the bureau’s own note, not a text that claims to be the bureau. Nextgov reported an internal email telling staff to protect themselves. Go through official channels. Do not click a “verify your file” link. [7]
- Freeze credit at Equifax, Experian, and TransUnion if a Social Security number may be in the set. The FTC says a freeze is free and does not change your score. [11]
- Do not download the stolen files, and do not use a site that offers to search them. That is how a second copy of you gets made.
A Mandiant researcher told Krebs the group is on pace for nearly $100 million in extortion payments in 2026. That is an analyst’s estimate, not a public ledger. The FBI warning in May said this crew inflates what it holds. Both things can be true: reporters did see real-looking samples, and the “everyone, forever, 3 terabytes” line is still the crew’s line. [6] [2]
The people in that file never agreed to be the bait in someone else’s argument with the FBI. The walk-back does not change that.
Sources
- [1] 404 Media, Sept. 22, 2026: Hackers say they have data on FBI employees
- [2] BleepingComputer, Sept. 22, 2026: Claims of a PeopleSoft breach and the FBI statement
- [3] Reuters, Sept. 25, 2026: Psychiatric and medical records claim
- [4] BleepingComputer, on the firewall dodge: PeopleSoft attacks resume past firewall rules
- [5] SecurityWeek, Sept. 28, 2026: Google warns of a fresh PeopleSoft campaign
- [6] Krebs on Security, Sept. 28, 2026: Dutch arrest, and the Mandiant payment estimate
- [7] Nextgov, Sept. 28, 2026: Group says it will not publish the FBI data
- [8] PCMag, Sept. 28, 2026: Threats come down, advisory stays up
- [9] The New York Times, Sept. 28, 2026: Internal damage assessment
- [10] Reuters, Sept. 28, 2026: Amsterdam arrest, police statement
- [11] Federal Trade Commission: Credit freezes and fraud alerts
