A digital extortion group says it has stolen personal data on every FBI employee and applicant, including home addresses, phone numbers, and details about their spouses.
The group, known as ShinyHunters, made the claim to 404 Media on Tuesday and handed the outlet a sample file containing the personal details of 5,000 alleged FBI employees.
That sample listed each person's name, address, phone number, and date of birth, and in some cases information about a spouse, according to the report. A representative for the group said the hack happened Monday night.
"We hacked the FBI. We hold data on all FBI employees and applicants," the representative told 404.
"This is extremely bad," national security journalist Michael Weiss wrote on X, sharing the report.
Criminals in the same ecosystem as ShinyHunters have previously used stolen phone records to track, intimidate, and harass the FBI agents investigating them, 404 Media reported. The outlet said the material would also be valuable to foreign intelligence services seeking to understand how the bureau works.
The outlet checked some sample phone numbers against the open-source intelligence tool OSINT Industries and found they matched people with the same names listed in the file.
Some of those numbers belong to Justice Department personnel, 404 Media co-founder Joseph Cox wrote on X, after running records through a compromised-data tool built by the security firm District 4.
Reuters partially verified personnel information from the sample by running names and postal addresses against credit bureau records and previously breached data held by the dark-web intelligence firm District 4 Labs. The news agency found matches in at least nine cases.
Reporters could not establish where the data came from, however, or whether the hackers took it from the FBI's internal systems as they claimed.
ShinyHunters also defaced the FBI's jobs website on Tuesday, according to 404 Media.
"[T]his site has been seized by ShinyHunters," the message read, mimicking the seizure notices the bureau places on websites it shuts down.
"All FBI data was compromised including PII/PHI [personally identifiable information and protected health information] on incumbent and former FBI employees and all applicant information," the message continued. "We have a lot more than we claim here."
"Thank you for your attention to this matter," the message concluded, echoing a sign-off President Donald Trump frequently uses on Truth Social.
The FBI's jobs site said Tuesday that it and the Special Agent Applicant Portal were "currently unavailable," 404 Media reported. BleepingComputer later said the site was offline for "maintenance."
The representative said the group exploited a previously unknown flaw in the Oracle business software PeopleSoft, then reached Amazon Web Services GovCloud servers and downloaded between two and three terabytes of material, according to 404 Media.
ShinyHunters targeted the bureau after an FBI announcement in May detailed the group's methods and urged targets not to pay, Reuters reported. The group typically threatens to publish stolen data unless victims pay a large fee.
"[W]hat we plan to do is not something I'd call extortion, maybe coercion," the representative said, when asked whether the group would try to extort the bureau. "This is not financially motivated."
The FBI did not immediately respond to 404 Media's request for comment.
The bureau's cyber division faced cuts that would reduce its personnel by half, Sen. Dick Durbin (D-IL) warned at a Senate Judiciary Committee hearing in September 2025, citing information his office had received.
FBI Director Kash Patel countered that arrests and convictions had increased under the Trump administration, CyberScoop reported.
Patel's own personal email account was breached in March by Handala Hack Team, an Iran-linked group that published more than 300 emails and photographs, CBS News reported.
"The information in question is historical in nature and involves no government information," the FBI said at the time.
