FBI Tells Its Employees to Assume Hackers Have Their Personal Data

In brief

• An internal FBI memo reportedly told employees to assume the hacker group ShinyHunters stole personal data on every staffer after a breach of FBIjobs.gov.
• The group claims 2 to 3 terabytes of data on agents, job applicants, and some spouses; the FBI says it is investigating and has not confirmed the scale.
• FBI Cyber Division chief Brett Leatherman addressed the hackers on Sept. 29, pointing to a Dutch arrest, as the one-week window the group set for a retraction ended.

The FBI has told its own employees to assume hackers stole their personal information, according to an internal memo reported this week by Reuters. The bureau is working from the premise that data on every staffer may be out, after a claimed breach of its jobs site, FBIjobs.gov.

The group claiming credit is ShinyHunters, a cybercrime crew that says it holds data on almost all FBI agents and everyone who applied for an FBI job. It puts the haul at 2 to 3 terabytes, including names, phone numbers, home addresses, and sometimes spouse details.

If the group is right, the damage reaches past agents. Anyone who applied for an FBI job could be in the files, by the group’s account.

The group says the intrusion began Monday night, and by Tuesday, Sept. 22, visitors saw a banner saying the site had been seized by ShinyHunters.

The group says it got in through a previously unknown flaw in Oracle’s PeopleSoft, software many organizations use to run HR. Security people call that a zero-day: a bug the vendor doesn’t know about, so there is no fix yet. The FBI has not confirmed the method.

The group says the trigger was an FBI advisory. In that May 15 notice, the bureau warned that ShinyHunters uses harassment, including threats to victims’ family members and, in some cases, swatting—a fake emergency call that sends armed police to someone’s door.

BitcoinBTC · USD$83,559−0.12%24H7D1M1YYTDSep 24Sep 26Sep 27Sep 29Oct 1$85.3k$84.4k$83.5k$82.7k24h HighHigh$85,51824h LowLow$83,022VolVol$1.7BMarket projectionsOdds by MyriadToday$82,000 to $84,000$82k–$84k65% chanceThis weekBelow $84,000Below $84k58% chance→Buy Bitcoin with USDTPowered by Jupiter$50$100$500BuyPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →

The group denies that. It gave the bureau one week to retract the warning.

ShinyHunters is not new. It surfaced in 2020 selling stolen databases on hacker forums, and helped run one of the biggest, BreachForums. Last year it claimed about 1.5 billion records from customers of Salesforce, a popular customer-data platform.

Then the FBI hit back. Cyber Division Chief Brett Leatherman posted a video on X on Sept. 29, pointing to a Dutch arrest from Sept. 15 and telling the hackers “we know how to find you.” He urged them to reach out first, and the group says the arrested man has no association with it.

FBI pitches ShinyHunters on cooperating: “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours. pic.twitter.com/LP90fjlsnO

— Ken Klippenstein (@kenklippenstein) September 29, 2026

ShinyHunters later said the ultimatum was a marketing campaign and that it doesn’t plan to publish the data. The memo also tells staff to expect virtual briefings and to watch for suspicious texts or calls from unknown numbers.

Why would a home address matter that much? Because stolen data rarely stays on a screen. If that data is released and employees get doxxed, employees could be threatened or harmed, identity theft cases may surge and relatives of doxxed FBI employees could be at risk.

Crypto has already shown the pattern. Coinbase said bribed support agents leaked customer data last year, then faced a $20 million extortion demand. As of April, France had recorded 135 crypto-related “wrench attacks” since 2023, and had charged 88 suspects.

In one case, attackers who beat a couple outside their Nancy apartment reportedly got their details from a January leak at Waltio, a French crypto tax platform that exposed about 50,000 users.

The one-week window the hackers set has passed, and ShinyHunters says it will not publish the data. The memo, as reported, tells staff to assume their data is already out.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.