ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report

Summary

The cybercrime group ShinyHunters claims to have breached FBI systems, including Criminal Justice, HR, and Medlink services, and alleges possession of data on FBI agents and job applicants. They defaced an FBIjobs.gov subdomain to protest an FBI FLASH report they claim contains false allegations. The FBI is investigating these claims, and a sample of data provided by ShinyHunters appears to be authentic.

Full text

The notorious cybercrime and extortion group ShinyHunters claims it breached FBI systems and accessed sensitive information. The hackers claim to have compromised Criminal Justice, HR, and Medlink services, and say they now possess data on nearly all FBI agents and job applicants. To demonstrate their claims, they defaced a subdomain on the FBI’s jobs website, fbijobs.gov, posting the message “This site has been seized by ShinyHunters”. The targeted domain is currently down for maintenance. In a lengthy statement on its website, ShinyHunters said it was responding to an FBI FLASH report from May that made what it called false allegations against the group. They gave the FBI one week to correct or remove the report. The group specifically disputed claims in the FBI report that they exaggerate their access to pressure victims into paying, use harassment tactics such as swatting or threats to victims’ families, and falsely claim to possess compromising photos or videos. ShinyHunters insisted its threats are genuine, denied ever conducting swatting or contacting victims’ families, and denied being “sextortionists”. The group also denied any affiliation with The Com, calling it a fabricated narrative pushed by the cybersecurity industry, and framed its statement as an exercise of First Amendment rights rather than an act of ransom, coercion, or extortion.Advertisement. Scroll to continue reading. FBI investigating ShinyHunters’ claims In a statement to the media, the FBI said it is “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” The agency has not shared any additional information. ShinyHunters provided 404 Media with a sample of the stolen data allegedly representing the personal information of 5,000 FBI employees, including names, phone numbers, and home addresses. 404 Media and others who reviewed the sample reported that at least some of the data appears authentic, but the origin of the data has yet to be confirmed. The hackers told 404 Media that they exploited a zero-day vulnerability in Oracle’s PeopleSoft product to breach FBI systems, from which they allegedly stole 2-3 TB of information. The cybersecurity community confirmed in June that ShinyHunters had been exploiting a PeopleSoft zero-day to steal data from organizations. It’s unclear whether the cybercrime group found a new zero-day or targeted the FBI through the same vulnerability, tracked as CVE-2026-35273. Related: BigCommerce Data Stolen via Ribon Apps Hack Related: CrowdSec Confirms Source Code Stolen in Supply Chain Attack Related: McKesson Confirms Data Breach as Attacker Deadline Looms Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider SchemeDragos Completes NetRise and runZero Acquisitions Following Accenture DealRust Team Members and Popular Crate Owners Targeted via Video CallsColorado Water Utilities Hit by Cyberattacks Targeting OT SystemsGoogle Confirms Gemini AI Breached Three FirmsAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code23 Million User Records Compromised in Gyazo Data Breach Microsoft Patches 18 Vulnerabilities in AI, Cloud Products Latest News Critical F5 BIG-IP Vulnerability Exploited as Zero-DayCheck Point Patches Exploited Management Server Zero-DayBigCommerce Data Stolen via Ribon Apps HackCyera Raises $400 Million at $12+ Billion ValuationNightmare Eclipse Drops New Microsoft Defender Exploit After Revealing IdentityOnly 13% of OT Network Segments Are Fully Isolated: AnalysisRecent ZyXEL Switch Vulnerability Exploited by Chinese HackersMalicious B-tree NPM Package Accumulates Millions of Downloads Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveVeritas Capital has appointed Joel Fulton as Chief Information Security Officer.incident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• domain — fbijobs.gov
• cve — CVE-2026-35273

Entities