The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency.
"We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark web site. "Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more."
The development was first reported by 404 Media. ShinyHunters said the FBI was targeted in response to a May 2026 public service announcement (PSA) that detailed the threat actor's targeting of Canvas, an online Learning Management System (LMS), while urging victims not to pay.
The attackers, in their own counter PSA, described them as "substantial false allegations," adding, "we were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to 'disrupt' our operations, an effort that ultimately proved unsuccessful."
The group has also rejected claims that it's part of The Com decentralized collective, calling it a "propaganda started by the Information Security Industry which has brainwashed past FBI and DOJ officials into formalizing this nonsense."
A ShinyHunters spokesperson told The Register that the group exploited a new Oracle PeopleSoft zero-day vulnerability to gain remote code execution and deface the FBI's jobs site with a "This site has been seized by ShinyHunters" banner. Visiting the site now reads: "Scheduled Maintenance Underway. We're Sniffing Out Site Updates for You!"
There are currently no details of a PeopleSoft pre-authenticated RCE zero-day. However, ShinyHunters weaponized a similar flaw (CVE-2026-35273) in June 2026 to break into enterprise networks and extort victims.
In a statement shared with Reuters, the FBI said it's "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."
The disclosure comes after the high-profile hacking group hijacked the dark web leak site of the Clop (aka Cl0p) ransomware crew.
"IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: [...] let's see how rich you really are," the notice read. "2.333% of my net worth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism."
"ShinyHunters; claim of an FBI breach is an unusually provocative move in the ongoing contest between law enforcement and cybercrime groups and should absolutely be taken seriously," Etay Maor, VP of threat intelligence at Cato Networks, said.
"We have seen threat actors target businesses countless times, and nation states or nation-state-connected groups have compromised law-enforcement organizations before—the 2015 OPM breach remains the most notable example—but a cybercrime brand publicly claiming an FBI compromise is different."
"One small operational clue is the September 23 timestamp on the group's post, while the news emerged on September 22 in the U.S. If that timestamp reflects the group's real operating environment, it points toward activity in Asia. It is not a definitive attribution, but it is a detail investigators will examine alongside the technical evidence."
Maor also described ShinyHunters as a resilient criminal brand that has managed to outlast takedowns, arrests, and forum seizures by evolving its methods and attracting new operators, suggesting it's more than a "fixed set of people or infrastructure."
"Its recent playbook has emphasized abusing trusted identity paths through help-desk social engineering, malicious OAuth applications, and stolen SaaS integration tokens, rather than simply breaking through a technical perimeter. That is the larger lesson here: organizations, including public-sector agencies, need to protect the identity and third-party trust relationships that attackers increasingly exploit."
ShinyHunters: Not Extorting the FBI
In a post shared on X, the FBI said it's "aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII)."
"While the point of breach is still undetermined—whether a third-party or the FBI's enterprise – we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk," it added.
In a statement shared with The Hacker News, a ShinyHunters spokesperson said the stolen data is around 2 TB and contains information from several FBI services.
"As our review progresses we can confirm data exposure concerning FBI PEGA, Medlink, FBIJOBS, HR, CJ, PHIRE, and we believe there are more internal FBI services data affected," the spokesperson added. "The Medlink database we have is very very very sensitive. The data in there has medical information, drug information, medical discharges, prescriptions, doctor clinic visits, diagnoses, any health issues with Agents, and a lot more data."
The group also emphasized that the hack was not financially motivated and that it's looking to "set the record straight," stating "the FBI deliberately put out disinformation regarding our organization because of issues stemming from broader folks within the InfoSec industry."
"Impersonators doing attacks that are not caused by us or sending out threatening emails/texts to certain journalists and security researchers. That is what has led the industry to make these false allegations against us. However, we believe those folks know we are not responsible for such conduct but continue to put out disinformation to harm our image and mutate victims' trust in paying us."
The spokesperson also called the group's alleged links to The Com umbrella as a "mischaracterization" that stems from overlaps in tactics, such as conducting social engineering and vishing attacks against identity providers like Okta and Entra SSO, which have also been used by Scattered Spider. Furthermore, it has denied having any connections with Scattered Spider.
"Historically, 'The Com' (much like older subcultures such as 'The Scene') was simply a loose digital culture and ecosystem, not a monolithic criminal organization," the spokesperson explained, describing "The Com" as an "ecosystem."
"While some threat actors have begun using the label for clout or attention due to heavy media focus, the FBI's formalization of this concept in its 2025 flash reports relies on industry hype rather than an accurate structural understanding of our operations."
(The story was updated after publication to include a response from ShinyHunters.)
