--- title: "FBI investigates claims that hackers stole pers… | Firevault" url: https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 description: "The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former…" lang: en-GB --- News · Breach Analysis # FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. **Mark Fermor**CTO, CMO and Founder, Firevault Published 22 September 2026 · 4 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-employee-applicant-data-breach-shinyhunters-2026)Email Personnel and applicant dossiers behind glass outside a federal headquarters at night, illustrating the claimed FBI recruitment-system breach ## What has been confirmed The FBI says it is investigating claims of unauthorised activity affecting FBIjobs.gov. Its recruitment website and Special Agent Applicant Portal were unavailable on 22 September 2026 after a page was reportedly defaced with a message attributed to the cybercriminal group ShinyHunters. That is the confirmed position at the time of publication. The FBI has not confirmed that personnel data was stolen, how an attacker may have entered its systems or how many people may be affected. ## What the attackers claim ShinyHunters claims it compromised an Oracle PeopleSoft system used for recruitment and human resources, then moved into FBI-managed cloud infrastructure. The group says it obtained between two and three terabytes of material covering current and former FBI personnel and people who had applied for jobs. Those technical details and the claimed total volume have not been independently verified. They remain statements made by the attackers, not findings published by the FBI. ## The sample seen by reporters 404 Media, which first reported the incident, reviewed a purported sample covering approximately 5,000 FBI personnel. It said the records included names, home addresses, telephone numbers and, in some cases, information about spouses. The publication reported that it matched some details against open-source records. Reuters later reported that it had partly verified information in the sample, while stressing that it could not verify the attackers' broader claim. This distinction matters: evidence that some records appear genuine does not establish that every FBI employee and applicant was exposed. ## Why personnel data can become a physical-security risk This is not simply a privacy issue. A reliable directory of agents, assignments, home addresses and family relationships could support surveillance, impersonation, coercion or targeted harassment. For law-enforcement and intelligence personnel, a connected personnel record can become a map to a person. The alleged route matters too. Recruitment and HR platforms need to communicate with applicants and staff, which makes them reachable and operationally useful. They should not inherit unrestricted access to the definitive archive of sensitive personnel records. ## The Firevault view Mark Fermor said: "An HR platform should not provide a route to a national-security archive. If a recruitment system must stay online, the retained personnel records behind it do not. Physical disconnection gives the most sensitive record set a boundary that a stolen account, an unknown software flaw and lateral movement cannot cross." Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® gives retained personnel, vetting and applicant records a physically disconnected home. The live service can continue to receive applications and support legitimate work, while the definitive archive remains beyond the network path an attacker is trying to extend. For connected operational systems, organisations should also isolate recruitment infrastructure, minimise service-account privileges, monitor lateral movement and prepare containment before an attacker's claim can be fully tested. Uncertainty about scale is a reason to contain quickly, not a reason to wait. ## Sources - Daily Mail: hackers claim to have stolen FBI personnel data: https://www.dailymail.com/news/article-16152547/Nightmare-Kash-Patel-hackers-steal-data-5-000-FBI-agents-issue-chilling-Trump-threat.html - 404 Media: the original report and review of the purported sample: https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/ - Reuters: ShinyHunters claims FBI breach: https://www.reuters.com/world/shinyhunters-hackers-say-they-breached-federal-bureau-investigation-no-immediate-2026-09-22/ - BleepingComputer: FBI confirms it is investigating the claims: https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/ ## Frequently asked questions ### Has the FBI confirmed that its personnel database was breached? No. The FBI has confirmed that it is investigating claims of unauthorised activity affecting FBIjobs.gov. It has not confirmed the claimed theft, entry method or scale. ### What information was allegedly exposed? A purported sample reviewed by reporters contained names, home addresses, telephone numbers and some spouse details. ShinyHunters claims the wider material includes current and former personnel and job applicants, but that full claim remains unverified. ### Why would an HR or recruitment breach matter to national security? Personnel and applicant records can identify agents, families, locations and relationships. That information may support targeting, impersonation, coercion or harassment even when operational case files are not exposed. ### How does physical disconnection reduce this risk? Physical disconnection removes the permanent network path to retained records. A compromised recruitment account or internet-facing application cannot directly enumerate or export an archive that is offline. ## Questions ## Sources and reporting notes 1. dailymail.com (https://www.dailymail.com/news/article-16152547/Nightmare-Kash-Patel-hackers-steal-data-5-000-FBI-agents-issue-chilling-Trump-threat.html)Primary reporting referenced in this analysis. Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More breach analysis - Breach Analysis · 21 Oct 2026**State Bank of India confirms data loss after 3,897 customer records found on the dark web**_Read the analysis_: https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026 - Breach Analysis · 21 Oct 2026**Cyberattack on cloud provider Arcadia may expose data of 125,000 Japanese police officers and staff**_Read the analysis_: https://fire-vault.com/news/arcadia-cyberattack-japan-police-data-breach-2026 - Breach Analysis · 15 Oct 2026**EY data breach: client tax records exposed through a support platform**_Read the analysis_: https://fire-vault.com/news/ey-data-breach-client-tax-records-october-2026 - Breach Analysis · 12 Oct 2026**ASOS data breach: stolen customer profiles and a hijacked app notification**_Read the analysis_: https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 - Breach Analysis · 25 Sept 2026**Dyfed-Powys Police confirms cyber attack as staff information may have been compromised**_Read the analysis_: https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 - Breach Analysis · 20 Sept 2026**Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later**_Read the analysis_: https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026#webpage", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026", "name": "FBI investigates claims that hackers stole pers…", "description": "The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "FBI investigates claims that hackers stole personnel and applicant data", "item": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "FBI investigates claims that hackers stole personnel and applicant data", "description": "The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed.", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-22T18:00:00+00:00", "dateModified": "2026-09-23T06:17:43.949957+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 674, "keywords": "Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What has been confirmed The FBI says it is investigating claims of unauthorised activity affecting FBIjobs.gov. Its recruitment website and Special Agent Applicant Portal were unavailable on 22 September 2026 after a page was reportedly defaced with a message attributed to the cybercriminal group ShinyHunters. That is the confirmed position at the time of publication. The FBI has not confirmed ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Has the FBI confirmed that its personnel database was breached?", "acceptedAnswer": { "@type": "Answer", "text": "No. The FBI has confirmed that it is investigating claims of unauthorised activity affecting FBIjobs.gov. It has not confirmed the claimed theft, entry method or scale." } }, { "@type": "Question", "name": "What information was allegedly exposed?", "acceptedAnswer": { "@type": "Answer", "text": "A purported sample reviewed by reporters contained names, home addresses, telephone numbers and some spouse details. ShinyHunters claims the wider material includes current and former personnel and job applicants, but that full claim remains unverified." } }, { "@type": "Question", "name": "Why would an HR or recruitment breach matter to national security?", "acceptedAnswer": { "@type": "Answer", "text": "Personnel and applicant records can identify agents, families, locations and relationships. That information may support targeting, impersonation, coercion or harassment even when operational case files are not exposed." } }, { "@type": "Question", "name": "How does physical disconnection reduce this risk?", "acceptedAnswer": { "@type": "Answer", "text": "Physical disconnection removes the permanent network path to retained records. A compromised recruitment account or internet-facing application cannot directly enumerate or export an archive that is offline." } } ] } ] ```