- Published on
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real
- Authors
- Name
- DeepHorus
The FBI is investigating claims that ShinyHunters stole sensitive data belonging to thousands of current and former employees by exploiting an unknown flaw in the bureau’s recruitment website. The probe concerns an alleged mass data theft from FBIJobs.gov, rather than just the defacement of its homepage. Officials have not publicly verified the attackers’ account. If confirmed, the incident would raise significant questions about federal cybersecurity, employee privacy, and counterintelligence.
404 Media reported on Tuesday that ShinyHunters took down FBIJobs.gov and displayed a banner reading, “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS.” The New York Times later reported the group’s claim that it had extracted two to three terabytes of data. The sequence suggests information may have been taken before attackers altered the public site, a pattern that can make a dramatic defacement mask a larger breach. Investigators must verify that claim through server records and other forensic evidence before drawing conclusions.
According to ShinyHunters, the stolen material includes names of current and former agents and applicants, home addresses, phone numbers, spouses’ names, and certain medical information. Bloomberg reported that a sample appeared to include potentially sensitive details about agents’ work, including counterintelligence operations involving China, Russia, and Iran, as well as work against street gangs. Such combined personal and professional information could enable targeted phishing, identity fraud, doxxing, or intelligence gathering. The complete dataset has not been published or independently assessed.
ShinyHunters said the operation was not an extortion attempt and that it did not seek a ransom from the FBI. Instead, the group described the attack as retaliation for a May FBI advisory warning that it wanted removed or edited. It alleged that the advisory contained disinformation intended to disrupt its operations. That motive remains a claim by the attackers rather than an established explanation.
In a message posted on the dark web and reviewed by Ars Technica, ShinyHunters said it was “severely offended” that the FBI alleged the group sometimes used “exaggerated claims” to extract payments. The group insisted its threats and breach claims were “very real,” adding that they were “not exaggerated” and “never a bluff.” That statement seeks to establish credibility, but reputation within criminal forums is no substitute for verification. The bureau’s warnings therefore remain important evidence to examine separately from the hackers’ assertions.
ShinyHunters also rejected the FBI’s assertions that it carries out swatting attacks against corporate workers and makes sextortion threats, declaring that such conduct “never” happens. Those denials show the adversarial relationship behind the alleged attack: the hackers appear to be using a large claimed breach to challenge the bureau’s warnings about their tactics. The FBI has not published a detailed technical rebuttal. Competing claims about the group’s behavior therefore remain largely unresolved.
No stolen data has been reported as leaked, making this an alleged theft and disruption rather than a confirmed public release. Even without publication, attackers can use records for extortion, spear-phishing, credential attacks, surveillance, or harassment, and some may be sold privately. Exposure involving specialized personnel could create operational risks beyond individual privacy. The possible inclusion of family and medical details broadens those concerns.
Investigators still need to confirm how much data was taken, how the unknown vulnerability was exploited, and whether the records shown to reporters came from the live FBI system. They may also examine notification obligations and incident-response procedures. The FBI could revise its threat assessment or warn affected individuals, but no public timetable establishes what comes next. A confirmed theft would strengthen the hackers’ credibility while renewing scrutiny of the bureau’s own warnings.
