FBI investigating hacking group’s claim of massive breach of agent info

The FBI headquarters in Washington.Andrew Harrer / Bloomberg via Getty Images fileShareAdd NBC News to GoogleSept. 23, 2026, 1:52 PM EDTBy Kevin CollierThe FBI said Wednesday that it is investigating a notorious hacking group over its claims to have stolen data on agents.

“The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” the FBI said in a statement. “While the point of breach is still undetermined — whether a third-party or the FBI’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.”

The hacking group, ShinyHunters, a cyber-extortion outfit that routinely hacks companies to steal their data and threatens to publish it on the dark web if not paid, said Wednesday that it had hacked into the FBI’s jobs portal and used that access to steal a major tranche of sensitive files, including ones that detail individual agents’ personal information.

In a post on its website viewed by NBC News, ShinyHunters said the alleged hack was retaliation for a public service announcement about the group that the FBI posted in May.

“We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to ‘disrupt’ our operations, an effort that ultimately proved unsuccessful,” it said. It disagreed with the FBI’s characterizations in its PSA and said it would publish hacked data in a week if the PSA was not retracted.

A representative of the group claimed to NBC News that they hacked the FBI’s job portal Monday and then gained access to other agency programs, stealing between 2 and 3 terabytes of files. NBC News was not able to verify the extent of their claims. The job portal site is currently inaccessible.

An agency spokesperson said: “The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”

Cynthia Kaiser, the former deputy cyber director of the FBI and a senior vice president at the cybersecurity company Halcyon, told NBC News that the alleged breach was worrying, as exposing personal information on FBI agents, who often sign their names to court documents used to prosecute criminals, endangers them.

“This type of information could be used by criminals to target or physically harm FBI agents, personnel and their families,” Kaiser said. “So I get concerned when you start thinking about physical addresses, who people’s spouses are, all of that.”

Kaiser said that ShinyHunters was unlikely to be outright lying about its access but that like most cybercriminal extortionists, it tends to exaggerate its claims.

“You often see a mixture of truth and lies when you’re dealing with threat actors like this,” she said. “They’re trying to show people, ‘Look what I have. You’re so scared of what I might show next, so you should do exactly what I should tell you to do, right?’”

ShinyHunters is a loosely defined group, with members scattered around the globe. AI company Anthropic released one clue about its operations in a threat intelligence report earlier this month, when it said it had since December repeatedly disrupted clusters of ShinyHunters affiliates trying to use the company’s AI in their hacking operations.

While some cybercriminals can operate with relative impunity in countries that do not extradite to the U.S., the FBI does regularly arrest cybercriminals directly or with the help of law enforcement in countries friendly to the U.S.

Antagonizing the FBI might tempt the agency to make more of an effort to arrest ShinyHunters members, Kaiser said.

“That’s normally a recipe for a takedown. There’s going to be more resources against them,” she said.

The ShinyHunters spokesperson said it was aware of that risk.

“We have been working on this since the release of the FBI FLASH report they made on us in May. This was well planned and coordinated,” the spokesperson said.

Kevin CollierKevin Collier is a reporter covering cybersecurity, privacy and technology policy for NBC News.