The 2026 FBI data breach was a cyberattack on the Federal Bureau of Investigation's recruitment portal, FBIJobs.gov, in September 2026, in which the extortion group ShinyHunters claimed to have stolen personal data on nearly all current and former FBI employees and job applicants. The FBI designated the matter a cybersecurity incident on September 22, 2026, and later attributed the intrusion to a contractor's failure to apply a security patch to an Oracle PeopleSoft system; the contractor, reported to be employed by Accenture, was removed. Current and former officials described the breach as one of the most serious compromises of bureau data in years, citing counterintelligence risks to agents and their families. By mid-October 2026, authorities in the Netherlands, Jordan, and the United States had arrested or detained three people in connection with the investigation.
ShinyHunters is a cybercriminal extortion group, active since 2019, that steals data from organizations and then threatens to release it publicly unless a ransom is paid. On May 15, 2026, the FBI's Internet Crime Complaint Center issued a public service announcement describing the group's tactics after its attack on the Canvas learning platform; the advisory said the group harassed victims and their families and sometimes exaggerated its access. In June 2026, Google's Mandiant reported that ShinyHunters was exploiting a vulnerability in Oracle PeopleSoft, CVE-2026-35273, against more than 100 organizations, chiefly in education; Oracle issued a security alert and fixes the same month.
The incident was the second reported compromise of an FBI system in 2026. In March, the bureau disclosed it was investigating suspicious activity on an internal system holding surveillance and investigative information, and a pro-Iranian group published personal documents it said came from an account belonging to Director Kash Patel.
According to the group, as reported by 404 Media, the intrusion began on the night of September 21, 2026, when attackers exploited a PeopleSoft server used by FBI recruiters and then moved into FBI-managed Amazon Web Services GovCloud infrastructure. ShinyHunters said that they bypassed web application firewall rules using URL encoding. The FBIJobs.gov site was defaced and then taken offline; by September 22 it displayed a maintenance notice, and it remained unavailable the following day.
On September 22, ShinyHunters posted a statement on its dark-web leak site addressed to Patel and to Cyber Division Assistant Director Brett Leatherman, claiming to hold "very sensitive data" on "almost ALL FBI Agents" and on job applicants. The group said the attack was not financially motivated and demanded that the FBI retract or correct the May advisory within one week, by September 29; it did not say what it would do otherwise. It told reporters it had taken two to three terabytes of data from systems it identified as HR, Medlink, and Criminal Justice, including medical information. The group provided several news organizations with a sample file containing names, home addresses, phone numbers, and relatives' information of roughly 5,000 FBI employees; Nextgov/FCW, 404 Media, and NBC News confirmed portions of it against public records or directly with individuals named in it.
A Justice Department notification to lawmakers said the affected system held Social Security numbers, dates of birth, phone numbers, addresses, and emergency-contact information. Reuters reported that the exposed material included descriptions of named employees' counterintelligence assignments, the street addresses of human-intelligence operatives, and medical and psychiatric records. On September 28, a ShinyHunters spokesperson told NBC News that the group would not publish the data and was withdrawing its demand, describing the episode as "a marketing campaign."
The FBI said on September 22 that it was "aware of claims regarding unauthorized activity affecting FBIjobs.gov" and was investigating; the following day it said the point of breach was undetermined. On September 25, the bureau emailed its workforce that it was operating on the assumption that data on all employees had been taken and urged staff to report unsolicited contact. CNN and NBC News reported frustration among employees who first learned of the breach from the media and considered the bureau's guidance slow; an FBI spokesperson said potentially affected employees had been notified repeatedly. Officials told CNN the data could allow foreign intelligence services or criminal organizations to identify agents in sensitive roles, including those working on China and Russia.
On October 5, Leatherman said in a statement to Reuters that the incident "occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform," and that the contractor had been removed. Reuters, citing two sources, identified the platform as Oracle PeopleSoft and the contractor's employer as Accenture; Accenture said it was "proud to support the mission of the FBI."
On September 15, 2026, before the breach, Dutch police arrested Pepijn van der Stap, a 24-year-old previously convicted hacker, in the ShinyHunters investigation. The FBI announced the arrest on September 29, describing him as one of the group's alleged leaders, and Leatherman urged remaining members to "reach out first while the choice is still yours." In early October, Reuters reported that a Jordanian teenager known online as "Rey", who sources said had taken control of the group after van der Stap's arrest, had been detained in Jordan and was cooperating with investigators.
On October 8, FBI agents arrested a Canadian cybersecurity executive in Philadelphia on charges of conspiracy to extort by threatening to disclose stolen information and Hobbs Act extortion; the complaint was filed under seal in the Eastern District of Texas, and a magistrate judge ordered him detained. Patel announced the arrest of "another suspected co-conspirator" without naming him, and the FBI has not publicly identified the defendant. As of mid-October, no unsealed charging document had publicly described any defendant's alleged role in the FBI intrusion.