INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI investigates ShinyHunters for alleged breach of its jobs site

| 2026-09-23 14:22 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
The FBI is investigating a breach of its job applications platform, with ShinyHunters claiming to have stolen information on current and former employees and applicants. The group has taken issue with the FBI's claims that it exaggerated the data it stole and threatened to leak more information if the white notice was not removed. As of Wednesday morning, the FBI jobs site still had a banner saying the special agent application portal is currently unavailable, indicating an ongoing investigation. ShinyHunters provided samples of 5,000 stolen FBI agent records to news outlets, which confirmed their legitimacy. The group has been in the crosshairs of the FBI for nearly one year after dozens of high-profile attacks on large companies and educational institutions.
Technical Mitigations AI-generated
• Replace the banner on <a href="/auth/login?next=/detail/U_fy0aABGvYhsJJThc25" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> with a new message to remove the threat of leaking sensitive information. • Block or hunt for Pokémon images and defacement attempts on websites, as ShinyHunters used this tactic in their breach. • Detect and monitor for suspicious activity related to data exfiltration and extortion attacks by groups claiming to have stolen FBI agent records.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
fb•••••.gov
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
Global Scope educationeducation
Incident Timeline
‎2026/09/22
Threat actors associated with ShinyHunters claimed that the FBI exaggerated the data stolen and extorted employees of hacked companies.
attribution FBI
In its message yesterday, ShinyHunters took issue with FBI claims that it exaggerated the data it stole and that it extorted the employees of the companies they hacked into.
threat_actor ShinyHunters
In its message yesterday, ShinyHunters took issue with FBI claims that it exaggerated the data it stole and that it extorted the employees of the companies they hacked into.
‎2026/09/23
ShinyHunters defaced the FBI's job applications platform and claimed to have stolen information on current and former employees and applicants.
threat_actor ShinyHunters
Brett Leatherman, assistant director of the FBI’s Cyber Division, spoke at length about the group during a roundtable two weeks ago, telling reporters that after successfully securing the arrest of members of a related cybercriminal group, the FBI is now “focused” on ShinyHunters “because right now it's a big problem when it comes to data exfiltration and extortion attacks.”
FBI investigating alleged ShinyHunters breach of its jobs site.
The group then took to its leak site to post a lengthy statement criticizing the FBI for a public service announcement released earlier this year that made several assertions ShinyHunters’ claims are false.
ShinyHunters provided samples of 5,000 stolen FBI agent records to 404media and several other news outlets, which confirmed their legitimacy.
The notice was issued by the FBI in May following ShinyHunters attack on educational software giant Instructure.
The ShinyHunters cybercriminal organization on Tuesday replaced agency images on the FBIjobs.gov site with a photo of a Pokemon that has become the group’s defacto mascot.
The agency did not respond to several other questions about the claims made by ShinyHunters.
“The bigger worry is ShinyHunters selling the data to other criminal or nation-state groups who could put it to more damaging use, rather than dumping it themselves,” said Andrew Brandt, incident responder at cybersecurity firm Huntress.
data_breach 5,000 stolen agent records
ShinyHunters provided samples of 5,000 stolen FBI agent records to 404media and several other news outlets, which confirmed their legitimacy.
organisation Pokemon
The ShinyHunters cybercriminal organization on Tuesday replaced agency images on the FBIjobs.gov site with a photo of a Pokemon that has become the group’s defacto mascot.
organisation Huntress
“The bigger worry is ShinyHunters selling the data to other criminal or nation-state groups who could put it to more damaging use, rather than dumping it themselves,” said Andrew Brandt, incident responder at cybersecurity firm Huntress.
organisation The Federal Bureau of Investigation
The Federal Bureau of Investigation is investigating a breach of its job applications platform after a cybercriminal group defaced the website and claimed to have stolen information on current and former employees and applicants.
Tactical Metrics
Metrics
data_breach
5,000
Stolen Agent Records
ShinyHunters provided samples of 5,000 stolen FBI agent records to 404media and several other news outlets, which confirmed their legitimacy.
Intelligence Sources
TheRecord 2026-09-23