Story perspectives

FBI Confirms Jobs Portal Hack Exposed Agents’ Personal Data

By Drooid · Sep 28, 2026, 9:56 PM UTC · How we work

Summary

FBI Data Breach

The FBI confirmed that a hack of its jobs portal stole agents’ personal data.
ShinyHunters claim to have names, addresses, Social Security numbers, assignments and family details of thousands.
The FBI is investigating the breach, which may involve its own systems or a third-party provider.
Officials warned stolen data could enable phishing, swatting, extortion, foreign-intelligence targeting and may require notifying Congress as a “major incident.”

Summary

ShinyHunters Deny Extortion

ShinyHunters denied extortion, calling the hack a “marketing campaign” against disinformation.
ShinyHunters said they altered their PeopleSoft exploit to bypass WAF rules by URL-encoding “P” as “%50”.
The group claimed the breach retaliated against an FBI advisory that called their tactics “exaggerated”.
ShinyHunters asserted their operations generate revenue that “significantly outperforms” rivals and legitimate businesses.
Researchers reported the group posted a sample of 5,000 FBI records on a forum, making copies irreversible.

History

Historical Context

The 2015 OPM breach, traced to hackers linked to China’s Jiangsu State Security Department, exposed about 22.1 million federal-employee SF-86 records and later revealed 5.6 million stolen fingerprints. That intrusion prompted a federal security overhaul and congressional calls for stricter cyber-risk laws. The recent ShinyHunters leak of the FBI jobs portal echoes those vulnerabilities, highlighting ongoing challenges for the FBI and DHS.

1 of 3

FBI Data Breach

The FBI confirmed that a hack of its jobs portal stole agents’ personal data.
ShinyHunters claim to have names, addresses, Social Security numbers, assignments and family details of thousands.
The FBI is investigating the breach, which may involve its own systems or a third-party provider.
Officials warned stolen data could enable phishing, swatting, extortion, foreign-intelligence targeting and may require notifying Congress as a “major incident.”

1 / 3