ShinyHunters, the hacking group behind breaches of Rockstar Games and Canvas, says it has stolen data on all FBI staff, including everyone who ever applied to join the agency. The hackers claim to hold personal details on around 38,000 people, and they are demanding the FBI withdraw a May advisory that called them “threat actors.”
The group says it found a vulnerability in the Oracle cloud storage system used by the FBI. The breach reportedly happened on Monday night, with hackers beginning to contact reporters on Tuesday. The BBC has seen a small portion of the data, which appears to be genuine.
What the hackers stole
ShinyHunters says the data includes names, roles, badge numbers, home addresses, phone numbers and spouse information for FBI staff. Some of the stolen files contain details about officials’ job assignments, including work against Chinese spies, Russian intelligence and drug cartels.
The hackers claim to have breached several FBI systems:
- FBIJOBS
- FBI BEAST (background checks)
- FBI MedLink (medical records)
- FBI BICS (investigation info)
ShinyHunters says it hacked for revenge over the FBI advisory, not money.
The advisory at the center of this
The FBI’s May advisory described ShinyHunters as “threat actors” who use real or exaggerated claims to prompt payments. It said the group targets major companies across tech, finance and retail, stealing millions of customer records.
The hackers gave the FBI one week to correct or remove the false allegations before publishing the full databases.
The FBI’s response so far
The FBI posted on X: “We are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.” The agency also said it was trying to determine whether the hackers breached its systems or a third party.
“We are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk”
Why this is a classic move
A cybersecurity expert, William Wright of Closed Door Security, called it a “retaliation attack” demonstrating no organisation is safe from the group. Wright also said the group wants to control the narrative around their activities.
This is not a new pattern. ShinyHunters has used stolen data to force companies into public statements or concessions. The tactic works because the threat of publication is real.
What happens next
The FBI investigation is ongoing. The agency has not yet confirmed whether the breach happened on its systems or on a third-party provider.
If the FBI confirms the breach, the situation becomes more serious. The stolen data includes sensitive personal information on current staff.
The stakes for the FBI
Withdrawing the advisory would be a public admission that the FBI’s assessment of ShinyHunters was wrong. Keeping it up risks publication of the stolen data, which could embarrass the agency and expose officials to harassment.
The hackers have been behind breaches of Rockstar Games and Canvas, and their methods have raised questions about how seriously law enforcement treats these attacks.
A warning to everyone
If it can be breached, anyone can be breached. The vulnerability ShinyHunters claims to have found in Oracle cloud storage is concerning.
Companies that store sensitive data in the cloud need to assume they will be compromised at some point. The question is not if, but when, and how prepared they are to respond.
The broader picture
Cybercrime is becoming more brazen. Groups like ShinyHunters operate with impunity, and the consequences for victims are severe. The FBI’s reputation is on the line, and so is the security of its staff.
The FBI has faced cyber threats before, but this one carries a political edge. The hackers are not interested in money; they want the FBI to admit it got the group wrong.
The FBI’s decision will shape how other agencies handle similar threats in the future. The investigation is still unfolding. The FBI has not confirmed the breach, and the hackers have not released all of their data. But the pattern is clear, and the stakes are high.
ShinyHunters is playing a dangerous game.
Where the paper stands
The paper backs the FBI’s right to warn the public about threats and is against any hacker group using stolen data to try to silence criticism. ShinyHunters has made its demand clear: take down the May advisory calling it a threat actor, or face the release of every record it stole. The FBI should keep its warning up and let the investigation run its course. The agency did nothing wrong in issuing that warning, and the hackers have no right to extort a retraction under threat of exposure.
ShinyHunters operates with impunity, and the FBI has faced cyber threats before. This breach, if confirmed, shows the vulnerability of even the nation’s law enforcement agency. The hackers have already stolen data from Rockstar Games and Canvas, and now they have turned their sights on the FBI itself. Their method is consistent: find a weakness, steal records, and use the threat of publication to control the narrative. That is a concentration of power by another name, and it should not be allowed to succeed.
The investigation is still unfolding, and the FBI has not confirmed the breach. ShinyHunters has not released all of its data either. The pattern is clear, however, and the stakes are high. The FBI’s decision on whether to withdraw the advisory will set a precedent for how other agencies handle similar threats in the future. The paper will continue to follow this story closely, watching for any sign that the FBI is backing down under pressure rather than standing firm against those who would silence its warnings.
Source material: “FBI investigates claim by hackers they stole data on all agency staff,” the BBC.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.