ShinyHunters claims FBI hack, gives bureau just 2 days to act before threatening to publish ‘all your data’ allegedly stolen in breach

Cyber extortion group ShinyHunters has issued a dramatic two-day deadline to the FBI, claiming it has compromised sensitive agency systems and threatening to publish the allegedly stolen information unless the bureau responds. The group wrote: “You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026.”

The threat follows a claim by the cybercrime group that it breached the FBI and obtained information belonging to agents and people who applied for jobs at the agency. The allegation has not been independently verified, although the FBI has acknowledged it is investigating claims of unauthorized activity involving its FBIJobs website.

A ShinyHunters spokesperson told The Register that the group allegedly exploited a new Oracle PeopleSoft zero-day to obtain remote code execution and deface the FBI’s jobs website. The attackers reportedly replaced the site with a banner reading, “This site has been seized by ShinyHunters.”


The website now displays a maintenance notice stating, “Scheduled Maintenance Underway. We're Sniffing Out Site Updates for You!”

ShinyHunters claims FBI employee data was compromised

In a statement posted through its leak infrastructure, ShinyHunters said, “We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job.”

The group further claimed that several FBI services had been affected, naming “Criminal Justice (CJ), HR, Medlink, and more.” It directed its message at FBI Cyber Division Assistant Director Brett Leatherman and FBI Director Kash Patel.

In a statement shared with Reuters, the bureau said it was “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”

Why ShinyHunters says it targeted the FBI

The group says the alleged intrusion was retaliation for an FBI public-service announcement issued in May 2026 concerning ShinyHunters' activity against an online learning-management system.

The May 15 FBI/Internet Crime Complaint Center advisory described ShinyHunters as a cybercriminal group specializing in large-scale data breaches and extortion. It warned that threat actors can use real or exaggerated claims of access to sensitive information to pressure victims, and said alleged ShinyHunters actors had used harassment tactics, including threatening communications and, in some cases, swatting.

ShinyHunters disputes those characterizations. In its response, the group called the FBI's allegations “substantial false allegations” and said it wanted the Q2 2026 FLASH report corrected or removed.

The group specifically rejected allegations involving swatting and threats against victims' families, saying, “We wish to state unequivocally our threats and claims are very real. Not exaggerated and never a bluff.” It also denied claiming possession of compromising photographs or videos and stated, “WE ARE NOT SEXTORTIONISTS.”