FBI data breach puts agents and families at risk

A major cyberattack on the FBI may have exposed the home addresses, Social Security numbers, family details and sensitive intelligence assignments of potentially tens of thousands of current and former employees, raising fears that the stolen information could put agents and their families at risk.

Nearly a week after the hacking group ShinyHunters disclosed the breach, the FBI is still trying to establish its full extent. The agency has acknowledged that personal information was stolen and has warned employees to be vigilant both at work and at home, according to an internal memo reported by The New York Times.

The bureau said on Monday that it was “working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted”.

Reuters has independently reviewed samples of the stolen material and partially authenticated the records. Its reporting found information identifying FBI personnel involved in sensitive assignments, including work targeting Chinese spies, Russian intelligence and drug cartels.

Agents and families potentially exposed

The scale of the personal information is particularly concerning.

According to the Times’ review of a sample of the data, records include names, home addresses, phone numbers, work email addresses, Social Security numbers, dates of birth and employment details of current and former FBI personnel.

Some records also contain names and contact information for spouses and emergency contacts — in certain cases including parents, siblings and children.

The data also includes employee identification numbers associated with the Transportation Security Administration’s PreCheck programme, potentially making it easier to track the travel of agents, including personnel working undercover.

Perhaps more troubling from a national-security perspective are details about where FBI personnel work. The files identify units, job titles and supervisors and include assignments involving counterintelligence, narcotics and national-security work focused on Russia, China and Iran, according to the Times.

Reuters separately found similarly detailed information about intelligence assignments in the material it reviewed.

Medical records also stolen

ShinyHunters has also claimed it obtained medical information, including psychiatric records and documents connected to blood and urine tests.

Reuters reported on Friday that it had reviewed documents containing sensitive psychiatric and medical evaluation information and had partially authenticated some of the files.

The combination of personal, professional and medical information could make the breach considerably more dangerous than an ordinary theft of employee records.

Security specialists have warned that foreign intelligence services could combine the material with information obtained from previous breaches to construct detailed profiles of FBI personnel. The information could also potentially be exploited by criminals seeking revenge against agents involved in investigations.

Ciaran Martin, former head of Britain’s National Cyber Security Centre, told the Times that the breach could have a “huge impact on the operational capability” of the FBI.

FBI assumes all employees affected

An internal FBI memo said the bureau was proceeding on the assumption that personally identifiable information belonging to all its employees had been taken, according to a person briefed on it cited by Reuters.

Employees have been advised to report unsolicited contacts or threats, avoid answering calls from unknown numbers and take additional precautions to protect themselves and their families.

ShinyHunters initially threatened consequences unless the FBI withdrew a public advisory issued earlier this year about the group. The advisory had warned that hackers associated with it were known to harass victims and relatives using threatening or coercive tactics.

The group has since softened its position, saying it would not publish the FBI data and that “nothing will happen”, Reuters reported.

Security experts nevertheless warn that a decision not to publicly release stolen information does not eliminate the danger that it could be privately sold or passed to criminals or foreign intelligence services.

PeopleSoft flaw under scrutiny

How the attackers entered the FBI system remains under investigation.

ShinyHunters has claimed it exploited Oracle’s PeopleSoft software. Google said last week that ShinyHunters had renewed the “mass exploitation” of a critical PeopleSoft vulnerability, identified as CVE-2026-35273, across multiple industries.

Google’s threat-intelligence researchers said the group had modified its technique to bypass some firewall protections. The company observed compromised systems across sectors including technology, healthcare, transportation and government.

Google did not say the vulnerability was responsible for the FBI breach, and the FBI has not publicly confirmed how its systems were penetrated.

Meanwhile, Dutch authorities have arrested a 24-year-old man as part of an investigation into ShinyHunters. His employer identified him as Pepijn van der Stap, a previously convicted cybercriminal who later worked as a cybersecurity professional. ShinyHunters denied that he was associated with the group.

The FBI’s Dallas field office has been investigating ShinyHunters with international partners, according to the Times.