--- title: "FBI investigates claims that hackers stole pers… | Firevault" url: https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 description: "The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former…" lang: en-GB --- News · Breach Analysis · 22 September 2026 # FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-employee-applicant-data-breach-shinyhunters-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-employee-applicant-data-breach-shinyhunters-2026&text=FBI%20investigates%20claims%20that%20hackers%20stole%20personnel%20and%20applicant%20data%0A%0AThe%20FBI%20is%20investigating%20unauthorised%20activity%20affecting%20its%20recruitment%20website%20after%20ShinyHunters%20claimed%20it%20stole%20sensitive%20records%20on%20current%20and%20former%20personnel%20and%20job%20applicants.%20The%20claimed%20scale%20remains%20unconfirmed. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-employee-applicant-data-breach-shinyhunters-2026 Image: Personnel and applicant dossiers behind glass outside a federal headquarters at night, illustrating the claimed FBI recruitment-system breach (https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg) Personnel and applicant dossiers behind glass outside a federal headquarters at night, illustrating the claimed FBI recruitment-system breach Why it matters ## What this means for organisations holding critical data ## What has been confirmed The FBI says it is investigating claims of unauthorised activity affecting FBIjobs.gov. Its recruitment website and Special Agent Applicant Portal were unavailable on 22 September 2026 after a page was reportedly defaced with a message attributed to the cybercriminal group ShinyHunters. That is the confirmed position at the time of publication. The FBI has not confirmed that personnel data was stolen, how an attacker may have entered its systems or how many people may be affected. ## What the attackers claim ShinyHunters claims it compromised an Oracle PeopleSoft system used for recruitment and human resources, then moved into FBI-managed cloud infrastructure. The group says it obtained between two and three terabytes of material covering current and former FBI personnel and people who had applied for jobs. Those technical details and the claimed total volume have not been independently verified. They remain statements made by the attackers, not findings published by the FBI. ## The sample seen by reporters 404 Media, which first reported the incident, reviewed a purported sample covering approximately 5,000 FBI personnel. It said the records included names, home addresses, telephone numbers and, in some cases, information about spouses. The publication reported that it matched some details against open-source records. Reuters later reported that it had partly verified information in the sample, while stressing that it could not verify the attackers' broader claim. This distinction matters: evidence that some records appear genuine does not establish that every FBI employee and applicant was exposed. ## Why personnel data can become a physical-security risk This is not simply a privacy issue. A reliable directory of agents, assignments, home addresses and family relationships could support surveillance, impersonation, coercion or targeted harassment. For law-enforcement and intelligence personnel, a connected personnel record can become a map to a person. The alleged route matters too. Recruitment and HR platforms need to communicate with applicants and staff, which makes them reachable and operationally useful. They should not inherit unrestricted access to the definitive archive of sensitive personnel records. ## The Firevault view Mark Fermor said: "An HR platform should not provide a route to a national-security archive. If a recruitment system must stay online, the retained personnel records behind it do not. Physical disconnection gives the most sensitive record set a boundary that a stolen account, an unknown software flaw and lateral movement cannot cross." Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® gives retained personnel, vetting and applicant records a physically disconnected home. The live service can continue to receive applications and support legitimate work, while the definitive archive remains beyond the network path an attacker is trying to extend. For connected operational systems, organisations should also isolate recruitment infrastructure, minimise service-account privileges, monitor lateral movement and prepare containment before an attacker's claim can be fully tested. Uncertainty about scale is a reason to contain quickly, not a reason to wait. ## Sources - Daily Mail: hackers claim to have stolen FBI personnel data: https://www.dailymail.com/news/article-16152547/Nightmare-Kash-Patel-hackers-steal-data-5-000-FBI-agents-issue-chilling-Trump-threat.html - 404 Media: the original report and review of the purported sample: https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/ - Reuters: ShinyHunters claims FBI breach: https://www.reuters.com/world/shinyhunters-hackers-say-they-breached-federal-bureau-investigation-no-immediate-2026-09-22/ - BleepingComputer: FBI confirms it is investigating the claims: https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/ ## Frequently asked questions ### Has the FBI confirmed that its personnel database was breached? No. The FBI has confirmed that it is investigating claims of unauthorised activity affecting FBIjobs.gov. It has not confirmed the claimed theft, entry method or scale. ### What information was allegedly exposed? A purported sample reviewed by reporters contained names, home addresses, telephone numbers and some spouse details. ShinyHunters claims the wider material includes current and former personnel and job applicants, but that full claim remains unverified. ### Why would an HR or recruitment breach matter to national security? Personnel and applicant records can identify agents, families, locations and relationships. That information may support targeting, impersonation, coercion or harassment even when operational case files are not exposed. ### How does physical disconnection reduce this risk? Physical disconnection removes the permanent network path to retained records. A compromised recruitment account or internet-facing application cannot directly enumerate or export an archive that is offline. Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis View original article (https://www.dailymail.com/news/article-16152547/Nightmare-Kash-Patel-hackers-steal-data-5-000-FBI-agents-issue-chilling-Trump-threat.html) About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Physical disconnection removes the path an attacker needs Offline Secure Storage® holds a clean copy of your data on hardware that is physically disconnected, so an intrusion cannot reach it, encrypt it or delete it. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Hardware**Your data sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Command**Access windows and retrieval under your control **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026#webpage", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026", "name": "FBI investigates claims that hackers stole pers…", "description": "The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "FBI investigates claims that hackers stole personnel and applicant data", "item": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "FBI investigates claims that hackers stole personnel and applicant data", "description": "The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed.", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-22T18:00:00+00:00", "dateModified": "2026-09-23T06:17:43.949957+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 674, "keywords": "Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What has been confirmed The FBI says it is investigating claims of unauthorised activity affecting FBIjobs.gov. Its recruitment website and Special Agent Applicant Portal were unavailable on 22 September 2026 after a page was reportedly defaced with a message attributed to the cybercriminal group ShinyHunters. That is the confirmed position at the time of publication. The FBI has not confirmed ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Has the FBI confirmed that its personnel database was breached?", "acceptedAnswer": { "@type": "Answer", "text": "No. The FBI has confirmed that it is investigating claims of unauthorised activity affecting FBIjobs.gov. It has not confirmed the claimed theft, entry method or scale." } }, { "@type": "Question", "name": "What information was allegedly exposed?", "acceptedAnswer": { "@type": "Answer", "text": "A purported sample reviewed by reporters contained names, home addresses, telephone numbers and some spouse details. ShinyHunters claims the wider material includes current and former personnel and job applicants, but that full claim remains unverified." } }, { "@type": "Question", "name": "Why would an HR or recruitment breach matter to national security?", "acceptedAnswer": { "@type": "Answer", "text": "Personnel and applicant records can identify agents, families, locations and relationships. That information may support targeting, impersonation, coercion or harassment even when operational case files are not exposed." } }, { "@type": "Question", "name": "How does physical disconnection reduce this risk?", "acceptedAnswer": { "@type": "Answer", "text": "Physical disconnection removes the permanent network path to retained records. A compromised recruitment account or internet-facing application cannot directly enumerate or export an archive that is offline." } } ] } ] ```