ShinyHunters claims attack on FBI exposes almost all agents
ShinyHunters claims it breached the FBI, defacing FBIjobs.gov and stealing sensitive data on almost all agents and job applicants.
ShinyHunters claimed responsibility for a September breach that temporarily defaced the FBI jobs site, with apply.fbijobs.gov and the Special Agent Application Portal still unavailable. The group claims it stole 'very sensitive data on almost all FBI agents' and job applicants, posting the claim on its data-leak site. Rather than a ransom, ShinyHunters appears to be coercing the FBI to amend or remove a May PSA about the group, setting a one-week deadline. ShinyHunters previously hit Instructure, Salesforce, Snowflake, and McKesson this year, typically via social engineering and identity-system weaknesses against cloud environments.
- FBI confirms investigating unauthorized activity at FBIjobs.gov; application portals remain offline
- Group claims sensitive data on nearly all FBI agents and job applicants
- Motive is coercing FBI to retract May PSA, with a one-week deadline
- Prior 2026 victims include Instructure, Salesforce, Snowflake, and McKesson
- ATT&CK
- T1566 PhishingT1491.002 External DefacementT1078 Valid AccountsT1567 Exfiltration Over Web Service
- Threat actors
- ShinyHunters
- Organizations
- FBIHalcyonFlashpointInstructure
From the original article
3 min read at cyberscoop.com
The FBI jobs site, which was temporarily defaced, remains unavailable and the agency said it’s investigating the claims. The post ShinyHunters claims attack on FBI exposes almost all agents appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.