Story summary
ShinyHunters, a notorious hacking group, claimed on September 22 that they breached the FBIjobs.gov website and stole personal data from thousands of current and former FBI employees. The hackers obtained sensitive information such as names, home addresses, phone numbers, email addresses, and dates of birth for many agents and job applicants. ShinyHunters defaced the FBI's jobs portal with a mocking message that included President Trump’s signature phrase "Thank you for your attention to this matter," implying retaliation against his administration.
The FBI acknowledged unauthorized activity affecting their job application site but did not confirm the theft of data. Reuters partially verified some stolen information by cross-referencing it with credit bureau records and previous breaches, finding matches in at least nine cases. The hackers threatened further action if the FBI does not address what they see as false allegations against them.
The breach potentially impacted a significant number of individuals who applied for or held positions within the FBI since 2017 when the site became the primary application platform for agent and support roles. The full extent of data compromised remains unclear, but ShinyHunters shared what they claim is a small sample dataset involving approximately 5,000 individuals.
Written for “FBI Data Breach” on 2026-10-05,
grounded in this article and the 22 other(s) covering the same event.
ShinyHunters hackers say they stole psychiatric and medical records of FBI staff
AI generated
asserted
they → say → staff
Federal Bureau of Investigation (FBI) personnel data recently stolen by the ShinyHunters hackers includes sensitive psychiatric and medical evaluation records, according to the hackers and documents reviewed by Reuters.
uncertain
data → steal → Reuters
ShinyHunters, one of the world’s most notorious and attention-seeking hacking crews, first said it had breached the FBI on Sept 22.
asserted
it → seek → Sept
In the hack, the group obtained granular details about bureau employees and their assignments, Reuters previously reported, including sensitive work against Chinese spies, Russian intelligence, drug cartels and others.
asserted
Reuters → obtain → spies
The breach has already rattled the bureau, but now threatens to turn into a serious counterintelligence risk, said Eric O’Neill, a former FBI operative who founded the cybersecurity consultancy Nexasure AI.
asserted
who → rattle → consultancy
O’Neill said the presence of medical data was a sign that the hack was approaching the same kind of magnitude as the 2015 intrusion into the Office of Personnel Management, which exposed millions of Americans’ sensitive clearance information, allegedly to Chinese intelligence.
uncertain
which → say → intelligence
He added that the data would be a powerful magnet for hostile spies.
asserted
data → add → spies
“I would be shocked if Russian intelligence isn’t knocking on their door and saying, ‘We want that stuff, hand it over,’” said O’Neill.
asserted
O’Neill → knock → it
The FBI declined to comment on the records.
asserted
FBI → decline → records
In a statement issued on Sept 23, the bureau said it was “aggressively investigating” the reported breach.
asserted
it → issue → breach
ShinyHunters circulated the medical files to a small circle of reporters earlier this week after announcing it had broken into the FBIjobs.gov site and stolen what it claimed was 2 to 3 terabytes of data.
asserted
it → circulate → data
The BBC earlier on Sept 25 reported that a blood and urine test document was among the sample, but the presence of other sensitive files, including a mental health evaluation and other records, has not previously been reported.
asserted
presence → report → evaluation
Reuters was able to partially authenticate some of the half-dozen files in several ways, including running two social security numbers in them against credit bureau data, and lining up the date of a pre-employment mental health evaluation against a former FBI analyst’s LinkedIn profile.
asserted
Reuters → authenticate → profile
Reuters also matched the name of an FBI psychiatrist in the document to a LinkedIn profile with the same name and an identical job title.
asserted
Reuters → match → name
In one case, Reuters was able to confirm with a person familiar with the matter that a medical professional listed in one of the documents as performing FBI evaluations was in fact doing so at the time, although the person could not authenticate the entire file.
uncertain
person → confirm → file
The person spoke on condition of anonymity because they were not authorised to discuss the matter.
asserted
they → speak → matter
The psychiatrist and the FBI employees named in the data either did not return messages or declined comment.
asserted
psychiatrist → name → comment
Documents include medical specifics
asserted
Documents → include → specifics
The documents reviewed by Reuters range in sensitivity.
asserted
documents → review → sensitivity
One medical record, which was part of a “fitness for duty” exam given to prospective employees, noted that an applicant took aspirin daily and was allergic to dust and cats.
asserted
applicant → give → dust
Another record said a potential employee exhibited “symptoms of depression” in high school.
asserted
employee → say → school
A third document carried an electrocardiogram result.
asserted
document → carry → result
Reuters could not establish whether the limited number of documents viewed were representative of the rest of the data trove held by ShinyHunters, or whether there even were other documents.
uncertain
number → establish → ShinyHunters
An FBI advisory released in May said the group has in the past exaggerated its level of access in an attempt to extort its victims.
uncertain
group → release → victims
ShinyHunters told Reuters on Sept 22 the data it had was “very very very sensitive” and included medical information, discharges, prescriptions, clinical visits, and “any health issues with agents”.
asserted
it → tell → agents
The hackers said they had compromised several of the bureau’s internal services, including the FBI’s background and employee applicant screening system, FBI MedLink, which contains agency personnel medical records, and the FBI’s Background Investigation Contract Services unit.
asserted
which → say → records
Reuters could not corroborate those specific allegations.
uncertain
Reuters → corroborate → allegations
Initially, the group said it would hold the data hostage until the FBI retracted its May advisory, which it said it took exception to.
uncertain
it → say → exception
Since then, ShinyHunters has removed that defiant statement from its website, saying on Sept 24 it would not comment on what it would do “if the victim does not comply with our kind request”.
asserted
victim → remove → request
The Aporia
