WASHINGTON, September 30 — The FBI has declared a “cyber security incident” after hackers stole personal data from the bureau’s job application portal, FBIJobs.gov, exposing sensitive information of agents and support staff. The breach, acknowledged in an internal notification to staff on September 28, 2026, exposed personally identifiable information including names, addresses, job titles, and Social Security numbers. The intrusion occurred via exploitation of a vulnerability in an Oracle PeopleSoft server hosting human resources data.
The hacking group ShinyHunters claimed responsibility, telling TechCrunch they possess data on “mostly all of FBI” and a “substantial” amount of information from applicants via the FBIJobs.gov portal. Media outlets confirmed the stolen data included medical information such as blood and urine sample records and psychiatric reports.
The FBI had previously acknowledged only that a hacking group claimed a cyberattack, with data theft still “undetermined” as of a statement issued the prior week. The bureau’s job portal has been the primary application method since 2017 and remained down at the time of publication.
Implications
Justin Sherman, a national security expert, described the breach in a Lawfare blog post as a “counterintelligence disaster” that could expose thousands of FBI personnel to profiling, phishing, and foreign intelligence approaches. Under federal law, the FBI must notify Congress if the incident qualifies as a “major incident”—defined as a breach involving theft of personally identifiable information likely to result in demonstrable harm to U.S. national security. It remains unclear whether such notification has occurred, though bureau lawyers are reportedly assessing the requirement.
If required, this would be the FBI’s second known notification to Congress this year about a data breach, following an earlier incident involving a surveillance system breach suspected to be linked to Chinese actors. The White House deferred comment to the FBI when asked about a major incident declaration, and the FBI did not respond to TechCrunch’s request for comment.
As the FBI works to secure its systems and assess the full extent of the breach, questions remain about the potential impact on national security and the bureau’s ability to protect sensitive information.
