FBI employees told to assume personal data stolen in breach

The FBI has instructed its employees to operate under the assumption that their personal data has been compromised following a breach of the bureau's jobs website, FBIjobs.gov. An internal memo, reported by Reuters, indicates the bureau believes data on all staff members may have been accessed.

The cybercrime group ShinyHunters has claimed responsibility for the breach, stating they possess 2 to 3 terabytes of data. This alleged haul includes personal information on FBI agents, job applicants, and in some cases, their spouses. The FBI has acknowledged an investigation is underway but has not confirmed the scale of the data theft.

ShinyHunters claims the intrusion exploited a previously unknown vulnerability in Oracle's PeopleSoft software, a common HR platform. The group stated the breach was triggered by an FBI advisory issued in May that warned of ShinyHunters' tactics, including harassment and swatting. The hackers reportedly gave the FBI one week to retract the warning.

FBI Cyber Division Chief Brett Leatherman addressed the hackers in a video posted on X on September 29, referencing a Dutch arrest and stating, "we know how to find you." He urged the group to reach out proactively. ShinyHunters, however, later claimed the ultimatum was a marketing tactic and that they do not intend to publish the stolen data. The internal memo also advised staff to prepare for virtual briefings and to be vigilant against suspicious communications.