News · Breach Analysis

FBI investigates claims that hackers stole personnel and applicant data

The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed.

Mark FermorCTO, CMO and Founder, Firevault

Published 22 September 2026 · 4 min read

What has been confirmed

The FBI says it is investigating claims of unauthorised activity affecting FBIjobs.gov. Its recruitment website and Special Agent Applicant Portal were unavailable on 22 September 2026 after a page was reportedly defaced with a message attributed to the cybercriminal group ShinyHunters.

That is the confirmed position at the time of publication. The FBI has not confirmed that personnel data was stolen, how an attacker may have entered its systems or how many people may be affected.

What the attackers claim

ShinyHunters claims it compromised an Oracle PeopleSoft system used for recruitment and human resources, then moved into FBI-managed cloud infrastructure. The group says it obtained between two and three terabytes of material covering current and former FBI personnel and people who had applied for jobs.

Those technical details and the claimed total volume have not been independently verified. They remain statements made by the attackers, not findings published by the FBI.

The sample seen by reporters

404 Media, which first reported the incident, reviewed a purported sample covering approximately 5,000 FBI personnel. It said the records included names, home addresses, telephone numbers and, in some cases, information about spouses. The publication reported that it matched some details against open-source records.

Reuters later reported that it had partly verified information in the sample, while stressing that it could not verify the attackers' broader claim. This distinction matters: evidence that some records appear genuine does not establish that every FBI employee and applicant was exposed.

Why personnel data can become a physical-security risk

This is not simply a privacy issue. A reliable directory of agents, assignments, home addresses and family relationships could support surveillance, impersonation, coercion or targeted harassment. For law-enforcement and intelligence personnel, a connected personnel record can become a map to a person.

The alleged route matters too. Recruitment and HR platforms need to communicate with applicants and staff, which makes them reachable and operationally useful. They should not inherit unrestricted access to the definitive archive of sensitive personnel records.

The Firevault view

Mark Fermor said: "An HR platform should not provide a route to a national-security archive. If a recruitment system must stay online, the retained personnel records behind it do not. Physical disconnection gives the most sensitive record set a boundary that a stolen account, an unknown software flaw and lateral movement cannot cross."

Offline Secure Storage® gives retained personnel, vetting and applicant records a physically disconnected home. The live service can continue to receive applications and support legitimate work, while the definitive archive remains beyond the network path an attacker is trying to extend.

For connected operational systems, organisations should also isolate recruitment infrastructure, minimise service-account privileges, monitor lateral movement and prepare containment before an attacker's claim can be fully tested. Uncertainty about scale is a reason to contain quickly, not a reason to wait.

Sources

• Daily Mail: hackers claim to have stolen FBI personnel data
• 404 Media: the original report and review of the purported sample
• Reuters: ShinyHunters claims FBI breach
• BleepingComputer: FBI confirms it is investigating the claims

Frequently asked questions

Has the FBI confirmed that its personnel database was breached?

No. The FBI has confirmed that it is investigating claims of unauthorised activity affecting FBIjobs.gov. It has not confirmed the claimed theft, entry method or scale.

What information was allegedly exposed?

A purported sample reviewed by reporters contained names, home addresses, telephone numbers and some spouse details. ShinyHunters claims the wider material includes current and former personnel and job applicants, but that full claim remains unverified.

Why would an HR or recruitment breach matter to national security?

Personnel and applicant records can identify agents, families, locations and relationships. That information may support targeting, impersonation, coercion or harassment even when operational case files are not exposed.

How does physical disconnection reduce this risk?

Physical disconnection removes the permanent network path to retained records. A compromised recruitment account or internet-facing application cannot directly enumerate or export an archive that is offline.

Sources and reporting notes

1. dailymail.comPrimary reporting referenced in this analysis.

Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor.