The Federal Bureau of Investigation is probing an apparent data breach of its recruitment systems by an extortion group claiming that "almost all" FBI agents and job applicants are exposed.
ShinyHunters, a black-hat hacker responsible for breaching the likes of Ticketmaster and Santander, said it had exploited a zero-day in PeopleSoft, an Oracle-owned HR management system that forms part of the FBI's recruitment infrastructure.
The FBI is yet to verify those assertions but confirmed it is aware of Shinyhunters' claims and is investigating.
In late 2025, Senator Mark Warner, vice chairman of the US Senate Select Committee on Intelligence, warned that changes made by the Trump administration at the FBI had put its cyber defences at risk, saying between 25% to 45% of agents working across cyber, counterterrorism, espionage and other critical missions had been reassigned to immigration enforcement
The latest incident comes less than two weeks after the bureau warned that attacks on shared services could have consequences across multiple organisations in its latest Cyber Strategy.
Ripple effect
“Criminal groups are targeting shared services," said Brett Leatherman, assistant director of the FBI's Cyber Division, while launching the FBI's new Cyber Strategy on 9 September, "so one intrusion ripples across many sectors."
In June, Google-owned Mandiant attributed a separate PeopleSoft exploitation campaign to ShinyHunters and notified more than 100 organisations whose systems appeared potentially vulnerable. Some suffered compromises and data theft. It is not yet clear whether the would-be FBI breach is connected.
If the group's claims this time around are accurate, the infraction could have significant national security implications, said Dr Petar Radanliev, a security researcher at the University of Oxford.
"Personnel records are not simply personal data," he told The Stack.
"Who works somewhere, in what role, with what history, and who applied - that supports targeting, social engineering, and the identification of people whose association with an organisation is meant to be non-obvious. That harm is durable in a way most breaches are not. A password can be changed; an employment history cannot."
See also: How a vibe-coded app let hackers use $600k worth of AI tokens at METR
Dr Radanliev cited the 2015 breach of the US Office of Personnel Management as a reference point for why this category of incident is handled differently. Data from 21.5 million people was stolen, including military records and federal employees' biometrics.
“The same HR and finance platforms sit underneath a very large number of government and corporate back offices,” he said, “and the pattern in recent years has been mass exploitation of one widely deployed product rather than a targeted intrusion into one organisation.”
If the ShinyHunters breach is genuine and of the scale which the hackers have implied, Dr Radanliev said, the onus now is on the FBI to establish how they gained access and whether other organisations running the same platform are exposed.
