FBI Hunts ShinyHunters After Employee Data Theft

The FBI is hunting the hackers who stole sensitive personal data belonging to its current and former employees, escalating a confrontation with the cybercriminal group ShinyHunters that has become one of the most serious security breaches to hit U.S. federal law enforcement in years.

In a video posted to social media, the assistant director of the FBI’s cyber division, Brett Leatherman, vowed to track down members of the group and urged them to cooperate. “You know how to find us, and we know how to find you,” Leatherman said, according to NPR, the outlet that first reported the bureau’s pursuit. “I suggest you reach out first while the choice is still yours.”

What Was Stolen

ShinyHunters claims to have breached the FBI’s careers portal, FBIJobs.gov, seizing between two and three terabytes of data covering what it describes as “mostly all” of the bureau’s agents and applicants. The group provided journalists with a sample of roughly 5,000 employee records. Reporters who reviewed the material found highly sensitive details, including names, home addresses, phone numbers, Social Security numbers, job titles and assignments, dates of birth, and information on spouses and family members.

The stolen trove also reportedly includes medical data such as blood and urine samples, as well as psychiatric reports — details that elevate the breach from a routine data theft to a potential national security problem.

According to Al Jazeera, the data includes granular detail about bureau officials’ job assignments, including sensitive work against Chinese spies, Russian intelligence, and drug cartels. The bureau has acknowledged the incident publicly while cautioning that the scope remains under investigation.

“The FBI is aware of a cybercriminal enterprise group claiming a compromise of the fbijobs.gov portal and alleged impact to FBI employee personally identifiable information,” the bureau said in a statement. “While the point of breach is still undetermined — whether a third-party or the FBI’s enterprise — we are actively and aggressively investigating this matter.”

A “Counterintelligence Disaster”

The breach has alarmed national security experts, who warn that the exposure of so many personnel records could be weaponized for years to come. Writing for Lawfare, national security expert Justin Sherman called the incident a “counterintelligence disaster” that would “expose thousands of FBI personnel to profiling, phishing, foreign intelligence approaches, and much more.”

Sherman noted that foreign adversaries such as Russia and China could attempt to obtain the data from ShinyHunters’ servers or from the dark web, using it to identify employees susceptible to blackmail, build organizational maps, and target individuals in sensitive roles. He also warned that the exposure of home addresses could enable doxing, swatting, and even violent retribution, particularly for those working cases involving organized crime, counterterrorism, and human trafficking.

One former senior FBI official told NPR the breach could be on par with the 2015 compromise of tens of millions of records from the Office of Personnel Management — a breach the U.S. government attributed to Chinese intelligence and described as an espionage operation. Unlike OPM, however, there is greater concern in this instance that the stolen materials could be exploited by criminal, terrorist, or nation-state actors.

Some retired employees who worked undercover might need protection services, including relocation assistance or even name changes, should their data be exposed publicly.

How the Hack Unfolded

While the FBI has not shared technical details about how hackers accessed its systems, Google’s Mandiant published research identifying a renewed mass-exploitation campaign by ShinyHunters targeting a vulnerability in Oracle PeopleSoft, an HR software tool used by the FBI and many other organizations. According to Google’s Threat Intelligence team, the group bypassed web application firewall protections by URL-encoding a single character in its requests — a technique that defeated defenses many operators believed had mitigated the flaw.

The campaign spanned higher education, technology, IT services, healthcare, agriculture, transportation, and government, illustrating how a single unpatched vulnerability can cascade across sectors.

The group defaced the FBI’s jobs portal with a counterfeit notice reading “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS,” forcing the application service and the Special Agent Applicant Portal offline.

An Arrest — and a Defiant Response

On Sept. 15, Dutch police arrested a 24-year-old man from Amsterdam who authorities describe as one of the group’s alleged leaders. The suspect, identified in reporting as Pepijn van der Stap, chief technology officer of Neo Security, was arrested at his workplace and remanded into custody for at least 90 days. According to TechCrunch, Dutch police said they found information on his laptop about two planned murders abroad, and he is being investigated for attempting to orchestrate them — a matter the authorities described as separate from the ShinyHunters inquiry.

The arrest, announced alongside the FBI on Sept. 29, preceded the theft of FBI personnel data, according to reporting, and it remains unclear whether it served as motivation for the breach. ShinyHunters has denied that van der Stap is associated with the group.

Rather than retreating, the group issued a defiant statement. This breach was not extortion, it insisted — it was a “marketing campaign to protect our business and actively combat disinformation.” ShinyHunters demanded that the FBI retract a May 2026 advisory describing the group as “threat actors” who exaggerate claims, and it gave the bureau a deadline of Sept. 30.

“Since the very beginning of this event we have unequivocally and assiduously emphasised this is NOT extortion, this is NOT ransom, this is NOT financially motivated,” the group said, according to SecurityWeek. ShinyHunters added that it never intended to publish the FBI data.

Security analysts doubt the arrest will end the group. “An arrest is a disruption, not an ending. ShinyHunters operates like a brand, not a fixed crew,” said Jason Brown, counter fraud lead at iCOUNTER. “Handles change and members rotate… The people still operating won’t stop. They’ll adapt.”

Frustration Inside the Bureau

Current and former FBI employees told NPR that many learned of the breach from media reports rather than from their own leadership, and expressed growing frustration with the bureau’s communication — including from Director Kash Patel — about who was affected and how the FBI plans to protect them.

The FBI has said it sent multiple “bureau wide communications within 24 hours of public reporting” of the breach and that it works “around the clock” on the investigation. But employees told NPR the messages came late and left key questions unanswered.

ShinyHunters claims to have breached more than 140 organizations and collected at least $70 million in extortion payments since 2025. Its past targets reportedly include Pornhub, Ticketmaster, AT&T, and Dutch telecom provider Odido.

What to Watch Next

Several questions remain unresolved. It is still unclear whether the FBI has formally declared a “major incident” — a threshold that, under federal guidance, triggers a requirement to alert Congress. A White House spokesperson deferred comment to the FBI when asked. TechCrunch reported that a disclosure would mark the bureau’s second known notification to lawmakers in 2026, following a suspected Chinese hack of a surveillance system earlier in the year.

The full scope of the breach, the exact number of affected personnel, and the origin of the intrusion — third-party vendor or FBI system — all remain under investigation. And with the Sept. 30 deadline now passed, the world is watching to see whether ShinyHunters follows through on its promise to keep the data private, and whether the FBI’s promised pursuit yields arrests.

For the thousands of FBI employees whose personal lives are now enmeshed in a criminal leak, the stakes are deeply personal — and they may not fade for years.