FBI Confirms Probe of ShinyHunters' Claimed Jobs Portal Breach

The FBI said Wednesday it is investigating claims by the hacking group ShinyHunters that it breached the bureau's job-application portal, FBIJobs.gov, and stole files containing agents' personally identifiable information, according to NBC News.

"The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII)," the bureau said in a statement quoted by NBC News. "While the point of breach is still undetermined — whether a third-party or the FBI's enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk."

What Did ShinyHunters Claim to Steal?

ShinyHunters, described by NBC News as a cyber-extortion group that routinely hacks companies and threatens to publish stolen data unless paid, posted on its own site that it had broken into FBIJobs.gov and used that access to pull sensitive files, including material detailing individual agents' personal information. A representative of the group told NBC News it gained initial access to the jobs portal on Monday, then pivoted into other agency programs, claiming to have exfiltrated between 2 and 3 terabytes of files. NBC News said it could not independently verify the scope of that claim. Separately, a former FBI agent told the outlet a sample document ShinyHunters sent as proof appeared to contain authentic sensitive personal information.

Why Does ShinyHunters Say It Targeted the FBI?

ShinyHunters framed the alleged hack as retaliation for a public service announcement the FBI issued about the group in May. "We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to 'disrupt' our operations, an effort that ultimately proved unsuccessful," the group wrote in a post viewed by NBC News. It disputed how the FBI characterized it in that PSA and said it would publish the stolen data within a week unless the bureau retracted the announcement.

What Is the FBI Doing Now, and Is the Portal Down?

FBIJobs.gov, the portal job applicants use to submit information to the bureau, was inaccessible as of NBC News' reporting. An FBI spokesperson gave a separate, shorter statement to the outlet: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." The bureau has not said whether the portal was taken offline deliberately as part of its response or whether the outage is tied to the alleged breach itself. It has also not confirmed whether the breach originated inside its own network or through a third-party vendor that supports the site — a distinction the FBI's own statement flags as still open.

Breach Claim: Timeline So Far

• May 2026: FBI issues a public service announcement about ShinyHunters that the group later cites as its motive.
• Monday (week of Sept. 21, 2026): ShinyHunters claims initial access to FBIJobs.gov, per its representative's account to NBC News.
• Wednesday, Sept. 23, 2026, 1:52 p.m. ET: NBC News publishes the FBI's confirmation that it is investigating the group's breach claim.
• Wednesday, Sept. 23, 2026, 5:25 p.m. ET: Story updated; FBIJobs.gov remains inaccessible.
• One week from ShinyHunters' post: Group's stated deadline for publishing stolen data unless the FBI retracts its May PSA.

Claim vs. Confirmation: The Numbers

• 2 to 3 terabytes: Volume of files ShinyHunters' representative claims was stolen, unverified by NBC News.
• 1 sample document: Material a former FBI agent told NBC News appeared to contain authentic PII.
• 7 days: Deadline ShinyHunters set for the FBI to retract its May statement before publishing data.

What to Watch

• Whether the FBI names the point of entry — its own systems or a third-party vendor supporting FBIJobs.gov.
• Whether ShinyHunters follows through on its one-week deadline to publish data.
• Whether FBIJobs.gov returns online and under what security changes.
• Any confirmation from the FBI on how many employees' PII was affected, a figure the bureau has not yet released.

The FBI's statement to NBC News did not specify a timeline for concluding the investigation or confirm the volume of data ShinyHunters claims to hold.