A notorious cybercriminal group claims it breached the FBI on Monday and stole data about personnel and job applicants.
uncertain
it → claim → personnel
The group, which calls itself ShinyHunters, claimed in communications posted on the dark web and exchanges with multiple media outlets that it stole 2 to 3 terabytes of data related to FBI and Justice Department workers.
asserted
it → call → workers
The hackers claim to have used a new vulnerability with Oracle PeopleSoft, a human resources management program.
uncertain
hackers → claim → PeopleSoft
RansomLook, an open-source ransomware intelligence archive that monitors data leak sites, has captured and archived two statements posted under the ShinyHunters identity concerning the group's claimed FBI breach.
asserted
that → monitor → breach
On Tuesday, ShinyHunters claimed in a post that was addressed to FBI Director Kash Patel and FBI Cyber Division Assistant Director Brett Leatherman: "We have compromised the FBI."
asserted
We → claim → FBI
The cybercriminals said they possessed sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs.
asserted
who → say → jobs
It listed criminal justice, human resources and Medlink systems among the services that were affected.
asserted
that → list → services
On Tuesday, the home page for FBI careers had a "System Unavailable" message at the top of the page.
asserted
page → have → page
It read, "Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable.
asserted
Apply.fbijobs.gov → read → ?
We apologize for the inconvenience."
asserted
We → apologize → inconvenience
The FBI has not confirmed the breach, but said Tuesday it was aware "of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."
uncertain
it → confirm → FBIjobs.gov
On Wednesday, the agency offered a more detailed statement: "The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII).
asserted
FBI → offer → information
While the point of breach is still undetermined — whether a third party or the FBI's enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk."
Reuters and 404 Media reported that portions of data supplied by the hackers to those media outlets correspond to real FBI or Justice Department personnel, though neither has established that the records came from FBI systems.
asserted
records → investigate → systems
CBS News has not independently verified these findings.
uncertain
News → verify → findings
FBI documents confirm that the agency's recruiting arm uses PeopleSoft and AWS GovCloud.
asserted
arm → confirm → PeopleSoft
The new software vulnerability, breach of the FBI's systems and large-scale data theft are plausible, though ShinyHunters' claims have not yet been verified by CBS News.
uncertain
claims → verify → News
In the group's post, which was saved by RansomLook, ShinyHunters complained about an FBI FLASH report issued during the second quarter of 2026 and disputed the bureau's characterization of the group and its tactics.
asserted
ShinyHunters → save → group
The group said the FBI had suggested that ShinyHunters sometimes exaggerates access, harasses victims or relatives, participates in swatting and falsely claims to possess compromising material.
uncertain
ShinyHunters → say → material
The group also took issue with the FBI's description of ShinyHunters, denying that its demands are financially motivated and rejecting descriptions of their actions as ransom, coercion or extortion.
asserted
demands → take → ransom
In May 2026, the FBI issued two warnings related to ShinyHunters-linked activity.
uncertain
FBI → issue → activity
A May 8 FLASH bulletin described what it called the group's ecosystem — warning of stolen credentials, abuse of trusted vendor and cloud relationships, plus data theft and extortion sometimes involving harassment.
uncertain
it → describe → harassment
A week later, an Internet Crime Complaint Center (IC3) advisory cautioned that actors using the ShinyHunters name may make real or exaggerated claims of access, threaten victims and relatives, engage in swatting and falsely allege they hold compromising material in order to pressure targets.
uncertain
they → caution → targets
In both warnings, the FBI advised organizations not to pay or engage with their demands.
asserted
FBI → advise → demands
The group gave the FBI a deadline of one week to "correct or remove" portions of the earlier FLASH report.
asserted
group → give → report
Earlier this year, from May 25 through June 9, Google also documented ShinyHunters exploiting a different Oracle PeopleSoft zero-day vulnerability.
uncertain
ShinyHunters → document → vulnerability
CBS News has reached out to Oracle for comment.
asserted
News → reach → comment
While it is widely known for executing large-scale data and cloud theft, security researchers treat it not as one single, fixed entity, but rather as a shifting ecosystem of threat actors.
asserted
researchers → know → actors
This is at least the third potentially major cyber incident to impact the FBI or its employees so far this year.
asserted
This → impact → FBI
In March, the FBI revealed it had
activity targeting one of its systems.
asserted
it → reveal → systems
That system stores unclassified and law enforcement sensitive information, such as pen registers — which are surveillance tools that record phone numbers, IP addresses, signaling and other information, in real time — and trap-and-trace surveillance returns, as well as personally identifiable information related to subjects of FBI criminal probes.
asserted
that → store → probes
The Aporia
