On September 22, 2026, the cybercriminal group ShinyHunters claimed responsibility for compromising F​B​I​j​o​b​s​.​g​o​v, the FBI’s recruitment portal, and stealing sensitive information relating to current and former employees and job applicants. The group claimed to have obtained between two and three terabytes of data and reportedly exploited a vulnerability in Oracle PeopleSoft, although the intrusion method has not been independently established. The FBI confirmed on September 23 that it was investigating unauthorized activity affecting the portal and working with third-party providers to assess and mitigate the risk. The website’s disruption added to concerns about the security of systems supporting government recruitment and personnel management.

On September 23, Reuters reported that a sample containing approximately 5,000 records included names, identifiers and job assignments associated with FBI personnel. Some records reportedly referenced sensitive counterintelligence and intelligence-related roles. Subsequent reporting on September 25 and 28 described additional exposed information, including home addresses, Social Security numbers and medical records. While media outlets verified portions of the sample, the full scope of the alleged theft and the group’s claim that it accessed data on nearly all FBI employees and applicants remain unconfirmed publicly. The FBI initially stated that investigators had not determined whether the breach originated within its own systems or a third-party provider.

ShinyHunters said the operation was not financially motivated and demanded that the FBI retract or correct a May 2026 public advisory describing the group’s cybercriminal activities. The incident highlights the risks posed by exposed recruitment platforms, vulnerabilities in enterprise applications and the potential consequences of leaking personnel information from law enforcement organizations. Exposed details could support targeted phishing, impersonation, harassment or intelligence-gathering activities. Organizations should review the security of externally accessible HR systems, investigate possible exploitation of Oracle PeopleSoft, validate third-party access controls, and monitor for suspicious activity involving employee accounts and personal information.