FBI Declares Cybersecurity Incident Over Stolen Employee Data
The Federal Bureau of Investigation has reportedly declared a “cyber security incident” after attackers accessed its job application portal and stole personal information belonging to FBI agents and support staff. An internal staff notification said exposed data included names, addresses, job titles and Social Security numbers.
The incident concerns FBIJobs.gov, the bureau’s primary employment application site since 2017. The portal remained unavailable at the time of publication. The declaration is the FBI’s first reported acknowledgement that its employees’ personal information was taken in the breach.
HR platform reportedly exposed sensitive records
The hacking group ShinyHunters told TechCrunch it had data on “mostly all of FBI” and a substantial amount of information on applicants who used the portal. Multiple media outlets also reported that the stolen data included medical information, including records related to blood and urine samples and psychiatric reports.
The FBI had said publicly the previous week that it was aware of a hacking group’s claim of an attack, while describing data theft as still undetermined. Its internal notification to personnel represents a more specific assessment of the incident’s impact.
ShinyHunters said it gained entry by exploiting a vulnerability in an Oracle PeopleSoft server. PeopleSoft systems can hold extensive human-resources records, making them a particularly sensitive target when they support recruitment and workforce administration.
Questions remain over notification and oversight
The group said it was not demanding a financial ransom. Instead, it sought a correction to an earlier FBI-issued report that it says mischaracterised its activities. An FBI spokesperson did not respond to a request for comment, and the White House also did not respond to a request about whether the bureau had declared a major incident.
Justin Sherman, a national security expert, described the breach as a “counterintelligence disaster” in a Lawfare blog post. He warned that the stolen records could expose thousands of FBI personnel to profiling, phishing and foreign-intelligence approaches.
Federal law requires notification to Congress when an intrusion meets the threshold for a major incident, including a breach involving personally identifiable information likely to cause demonstrable harm to US national security. It was not clear whether lawmakers with FBI oversight had received a disclosure.
The episode is a practical warning for organisations operating HR portals and systems containing medical or identity data. They need to identify internet-exposed enterprise software, apply security updates promptly, limit access to sensitive records and maintain a response process that can notify affected staff quickly when a breach is confirmed.