In a video posted on social media, the assistant director of the FBI's cyber division, Brett Leatherman, vowed Tuesday to hunt down the members of a cybercriminal group going by the name of ShinyHunters, the same group that last week claimed to steal reams of sensitive data from the FBI itself.
"You know how to find us, and we know how to find you," Leatherman said in the video, encouraging the prolific group of loosely connected data extortionists to come forward and share information or face the consequences. "I suggest you reach out first while the choice is still yours."
The FBI says it is "aggressively" investigating the breach and how hackers got ahold of sensitive FBI employment information, including whether the hackers got into third-party software or the FBI's own internal systems. In a statement emailed to NPR, a FBI spokesperson said the bureau is working "around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted."
It's still unclear how much information was stolen, though media organizations and threat intelligence researchers have already verified the authenticity of some of the stolen materials. Meanwhile, a defacement message was posted on the FBI's jobs website late last week where ShinyHunters took credit for the attack, and the site was temporarily taken down.
Current and former FBI employees familiar with the matter, who spoke to NPR on condition of anonymity because they feared reprisal for speaking about an ongoing investigation, said many employees first found out about the breach from media reports. They suggested there could be as many as several terabytes of text files in the data tranche, including FBI job applications, details on promotions, information on sensitive job postings, family details, medical data and more. Those same employees, particularly those who have retired, say there's growing frustration with FBI leadership, including FBI Director Kash Patel, about the lack of communication about the breach, exactly who is impacted, and how the FBI plans to protect its current and former employees. Some retired employees who worked undercover might need protection services like relocation assistance or even name changes if their data is exposed publicly.
The FBI told NPR it sent multiple "bureau wide communications within 24 hours of public reporting" of the breach" and that "the FBI treats the security of its own information and the safety of its workforce as top priorities."
One former senior FBI official told NPR the breach could be on par with the 2015 compromise of tens of millions of sensitive government employee records from the Office of Personnel Management. The U.S. government attributed that breach to the Chinese government and described it as a widespread espionage operation designed to identify potential targets for intelligence gathering.
However, unlike the OPM breach, there is more concern in this instance that the stolen materials will fall into the wrong hands or be otherwise weaponized, either by ShinyHunters or any number of criminal, terrorist, or nation-state organizations seeking to pilfer the stolen files. ShinyHunters has come out and said it never intended to leak the files, despite giving a deadline of Sept. 30 for the FBI to amend previously published press releases about the group that it argued were inaccurate, but that doesn't necessarily prevent further theft or exploitation of the data.
The bureau and its former employees are "bracing for impact" and assume that the stolen materials may be irretrievably compromised, according to the former senior FBI official.
But experts argue that the ShinyHunters members, which many threat intelligence researchers have previously identified as a loose collective of young hackers around the world, should also brace themselves for the FBI's response.
Cynthia Kaiser, the former FBI deputy director of the cyber division who currently leads ransomware research at cybersecurity company Halcyon, described the hackers as "reckless" for targeting the FBI, particularly knowing the FBI has a clear policy of not paying a ransom or negotiating with criminal actors. "When any threat actor targets the FBI directly, they should expect that the FBI is going to marshall additional resources to bring them quickly to justice," she wrote in a social media post.
While the FBI has promised to seek the information to make arrests against ShinyHunters hackers in the wake of this breach, it's unclear how imminent those actions might be.
The FBI's video posted on social media also featured a recently announced arrest of one alleged member of ShinyHunters in Amsterdam by the Dutch National Police, an operation the FBI thanked its Dutch partners for leading. However, that arrest preceded the ShinyHunters theft of FBI personnel data, according to the former senior FBI official familiar with the matter. It's unclear if that arrest served as motivation for the breach of FBI data and whether there was concern about potential retaliation following that arrest.
While the FBI has not shared any technical details about how the hackers got into its systems, Google's Mandiant published new research revealing that ShinyHunters is currently targeting a vulnerability in a human resources software tool called PeopleSoft, which is owned by tech giant Oracle. PeopleSoft is a tool used by the FBI, among other major clients in IT services, corporations, government, academia and beyond.
Google originally disclosed information about the vulnerability and its exploitation in June and revealed that while the company released a patch, some customers instead implemented protections like a firewall to attempt to prevent bad actors from exploiting it. Ultimately, ShinyHunters has managed to easily bypass those controls.
Copyright 2026 NPR
