ShinyHunters is publicly downplaying its hack of the FBI’s jobs portal, casting the intrusion as a “marketing campaign” and insisting it never planned to leak the trove of bureau personnel data it says it stole, even as the FBI’s top cyber official urges remaining members to turn themselves in.[3][7][9][10][14] The group’s defiant messaging comes days after Dutch authorities arrested a suspected leader, heightening pressure on the long-active extortion crew.[1][4][5]
The breach centers on FBIjobs.gov, the portal used to collect applications for bureau positions, which ShinyHunters claims it compromised on September 21 before siphoning off two to three terabytes of data tied to “almost all” FBI agents and job applicants.[3][13][15] Journalists who have seen a sample—a roughly 5,000-line spreadsheet—say the records include names, home addresses, phone numbers, dates of birth, Social Security numbers and emergency contact details for thousands of employees, underscoring how sensitive the exposed information is.[3][10][15] In a notification to lawmakers, the Justice Department classified the incident as a cybersecurity event and acknowledged that investigators are still working to determine how many people are affected and how the attackers gained access to the portal.[3][13]
In an unusually direct video address, FBI Cyber Division Assistant Director Brett Leatherman told ShinyHunters members “you know how to find us, and we know how to find you,” urging them to reach out “while the choice is still yours.”[4][7][9][11][14] Leatherman’s warning accompanied confirmation from Dutch authorities that they had arrested Amsterdam resident Pepijn van der Stap, who was allegedly a key figure in ShinyHunters and had previously been sentenced to four years in prison in 2023 for hacking and extortion before being released on probation.[1][4] Officials say ShinyHunters and its co-conspirators have breached more than 140 organizations and collected at least $70 million in extortion payments since last year, highlighting the group’s global impact and the scale of law enforcement’s pursuit.[4]
ShinyHunters, for its part, has tried to recast the FBI breach as reputational warfare rather than a traditional financially motivated ransom scheme.[5][10][15] The group earlier gave the bureau a week to retract or correct a public service announcement about ShinyHunters that it described as containing “substantial false allegations,” but later claimed the ultimatum was neither a deadline nor a threat and that it never intended to dump the data.[7][10][14][15] Members have told reporters that the operation was meant to draw attention to what they view as unfair characterization by the FBI, with one spokesperson stressing that the breach “is NOT financially motivated.”[10][15] In subsequent statements, ShinyHunters has repeatedly said it will not publish the stolen records and characterized the episode as “all a marketing campaign.”[5][7][9]
Despite those assurances, the mere existence of a massive archive of FBI personnel information in criminal hands poses obvious risks for identity theft, targeted phishing, social engineering and potentially physical threats against law enforcement officials.[3][10][13] The FBI has acknowledged it is investigating unauthorized activity affecting the jobs portal and has begun notifying affected individuals, while also working to understand whether any additional systems tied to criminal justice, human resources or medical services were touched by the intrusion.[13][15] With investigators still determining the full scope of the compromise, security experts warn that any later leak or sale of the data—whether by ShinyHunters or another actor—could have long-term consequences for the safety and privacy of current and former FBI personnel.[3][10]
Technical details about the initial entry point have not yet been made public, and neither the FBI nor external analysts have shared vulnerability identifiers or exploit chains associated with the breach, leaving defenders to focus on hardening similar public-facing portals and identity stores.[3][13][15] Organizations running recruitment and HR platforms that aggregate large volumes of personal data can draw clear lessons from the incident: keep those systems segmented, enforce strong authentication and access controls, rigorously patch web applications and third-party components, and maintain logging robust enough to spot unusual data exfiltration patterns quickly. While ShinyHunters now portrays its FBIjobs.gov operation as a publicity stunt, its broader history of intrusion and extortion makes clear that any access it gains to sensitive repositories—public or private—is a material security risk that demands sustained monitoring and readiness to respond.[4][5][9]
References
- ShinyHunters Defiant After FBI Calls on Members to Come Forward
- FBI sends warning to cybercrime group that hacked it after …
- FBI warns ShinyHunters members to come forward after …
- FBI’s Top Cyber Guy Warns ShinyHunters Crew That They Better Watch Their Backs
- FBI official tells hackers to get in touch, says ‘we know how …
- After Breach, FBI Hits Back at ShinyHunters: ‘We Know How to Find You’
- ShinyHunters hackers say they won’t leak sensitive FBI data
- FBI to ShinyHunters: ‘We know how to find you’
- ShinyHunters claims FBIjobs.gov breach as FBI …
- FBI urges ShinyHunters hackers to make contact after …
- ShinyHunters says it stole FBI employee data. Here’s what we know.
