ShinyHunters claims FBI breach, says it stole PII on every employee and applicant

The extortion crew ShinyHunters says it broke into FBI systems and made off with personal records on the bureau’s entire workforce and applicant pool. A group representative gave 404 Media a sample of roughly 5,000 records containing names, home addresses, phone numbers, dates of birth, and in some cases spousal details. Independent checks against OSINT tools and a breach-lookup service lined the phone numbers up with real people, and some tied back to Department of Justice personnel. The FBI has confirmed only that it is investigating unauthorized activity on FBIjobs.gov, which now sits offline after the group defaced it with a mock seizure notice.

According to the group, the intrusion started with a zero-day in Oracle’s PeopleSoft software, which it used as a foothold to reach AWS GovCloud servers and pull down an alleged two to three terabytes of data. That access path — a widely deployed HR platform bridging into a government cloud tenant — is the more consequential technical claim here, and one the FBI has not addressed.

What makes this different from ShinyHunters’ usual playbook is motive. The group typically steals data and demands payment, but a ransom against the FBI is a non-starter, so the representative reframed its intentions as “coercion” rather than extortion and said the operation isn’t financially driven. The real leverage appears to be a demand that the bureau retract a prior report accusing the group of swatting and threatening victims’ families, backed by a one-week ultimatum. If the trove is genuine, the exposure of agents’ home addresses and family information poses tangible physical-safety and counterintelligence risks well beyond the usual data-leak fallout.