ShinyHunters, a data-extortion group whose activity and shifting membership are documented back to at least 2020, picked an unusually bold target last month: the FBI itself. NBC News reported that the jobs-portal breach actually began on September 21, 2026, and by the next day the extortion crew had posted a message addressed to FBI Director Kash Patel and FBI Cyber Division Assistant Director Brett Leatherman that read simply, “We have compromised the FBI,” according to CBS News. Within hours, FBIjobs.gov was defaced and taken offline, and a hacking crew best known for hitting retailers, hospitals, and cloud vendors was suddenly claiming to hold personnel files on the agency that tracks it.
Three weeks later, the picture is still messier than the group’s own claims suggest, even as the law enforcement response has snowballed. The FBI has confirmed an incident and opened an investigation, samples of the leaked data appear to include at least some real information, and Dutch authorities have arrested a 24-year-old suspect tied to the group’s extortion activity. Reuters has since reported that ShinyHunters’ leak website went offline on September 30, 2026, that an alleged leader of the group was detained in Jordan by October 3, 2026, and that the FBI itself arrested one additional suspect on October 9, 2026, according to the Associated Press. But the group’s headline numbers, including a claimed 2 to 3 terabytes of stolen data and access to “almost ALL FBI Agents,” remain unverified by any named outlet or by the bureau itself. Understanding what’s confirmed, what’s alleged, and who ShinyHunters actually is requires separating three years of documented breaches from a month of dramatic claims and an escalating law enforcement crackdown.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What ShinyHunters Actually Claimed About the FBI
According to Reuters and SecurityWeek, ShinyHunters said it obtained names, home addresses, phone numbers, spouse information, and medical details tied to FBI employees and applicants, sourced from the bureau’s online jobs portal, and Reuters reported in September 2026 that the group claimed the haul covered data on almost all FBI agents and job applicants. The group also claimed access to systems it described as related to criminal-justice records, human-resources data, and medical-link services, and put the total haul at 2 to 3 terabytes, a figure BleepingComputer reported ShinyHunters was still repeating as of October 2026. Reuters separately reported that ShinyHunters claimed to have obtained psychiatric and medical records belonging to FBI staff, a claim that has not been independently verified.
The motive the group gave was retaliation. The FBI issued a public advisory in May 2026 describing ShinyHunters’ tactics and urging victims not to pay extortion demands, cataloged at IC3.gov as PSA 260515. According to Reuters, ShinyHunters cited that advisory directly as the reason it targeted the bureau, and reportedly demanded the FBI “correct or simply REMOVE” the report, per SecurityWeek. That is a notable shift from the group’s usual playbook: most ShinyHunters extortion attempts ask victims for money or silence, not for a government agency to retract a warning about the group’s own methods.
404 Media reported it received a sample of the alleged data covering roughly 5,000 FBI employees, including names, phone numbers, and home addresses, and Reuters reported separately in September 2026 that ShinyHunters had offered records on roughly 5,000 agents as a sample to prove its claim. The New York Times reported that cross-checking some of that sample against publicly available information suggested at least part of it was likely legitimate personal data, though the paper stopped short of confirming the full scope, source, or total volume the group has claimed.
What the FBI Has Actually Confirmed
The bureau’s public response has been careful and incremental. Its first statement, given to CNN, said only: “The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” A more detailed statement followed, reported by CBS News: “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII).” The bureau added that “while the point of breach is still undetermined — whether a third-party or the FBI’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk,” according to the same CBS News report.
That last line matters. It tells us the FBI itself is not yet certain whether its own network was penetrated or whether a third-party contractor that runs the jobs portal was the actual entry point, which is a distinction that changes the scale and liability of the incident considerably. The New York Times reported on September 28 that FBI leadership had internally characterized the situation as a cybersecurity incident and acknowledged that employee personal information, including home addresses and Social Security numbers, had been exposed. That is a meaningfully stronger acknowledgment than the bureau’s public statements, but it still falls short of confirming ShinyHunters’ 2-3 terabyte figure or its claim of reaching “almost all” agents.
Cybersecurity Insiders‘ coverage has been the most explicitly cautious among outlets tracking the story, arguing that until the FBI or an independent investigator verifies the source and scope of the data, the more dramatic claims should be treated as unconfirmed. That is a reasonable default for a group with a documented history of inflating breach totals to increase leverage during extortion negotiations, a pattern this site has tracked through earlier phases of the same saga, from the initial 2-3TB claim to the bureau’s own acknowledgment that thousands of agents were notified.
Who Is ShinyHunters? A Three-Year Trail of Breaches
ShinyHunters is not a new name in cybersecurity reporting. The FBI’s own May 2026 advisory described the group plainly: “ShinyHunters (SH) — which claimed the cyber-attack that caused the disruption — is a cyber criminal group specializing in large-scale data breaches and extortion.” That description tracks with years of prior activity. French national Sébastien Raoult was arrested in Morocco in 2022 in connection with cybercrime attributed to the ShinyHunters ecosystem, extradited to the United States, and later convicted and sentenced to three years in prison, according to CybelAngel’s retrospective on the group. That makes Raoult one of the few individuals tied to the ShinyHunters name whose case has actually reached a final conviction, rather than an arrest or a charge still working through the courts.
French authorities arrested four more people on June 25, 2025, in connection with aliases including “ShinyHunters,” “Hollow,” “Noct,” and “Depressed,” per CybelAngel. None of those four has been reported as convicted; their cases remain part of an ongoing French investigation. The enforcement action tied to the FBI breach specifically moved quickly: Reuters and The Hacker News reported that Dutch police apprehended a 24-year-old suspect in Amsterdam on September 15, 2026, a person with a prior history of cyber offenses believed to have assisted in ShinyHunters-linked theft and extortion. The crackdown widened from there. Reuters reported that an alleged leader of the group was detained in Jordan by October 3, 2026, and the FBI itself announced the arrest of one additional suspect on October 9, 2026, according to the Associated Press. As with the French suspects, all of these individuals have been arrested, not convicted, and the reporting does not establish that every person detained was a core member of the group rather than an affiliate or contractor.
Between those arrests, ShinyHunters or actors using the name have been linked to a long list of corporate victims, spanning retail, healthcare, gaming, and financial services. Startup Fortune reported a ShinyHunters claim of 7.1 million stolen records from healthcare and medical-device maker Baxter International in August 2026, a figure that, like the FBI numbers, originates from the group itself rather than from independent verification. The group also claimed responsibility for a Snowflake-linked breach tied to Rockstar Games earlier this year, part of the same wave of cloud-platform extortion campaigns that made ShinyHunters a fixture in breach disclosures well before the FBI incident.
Major Breaches Linked to ShinyHunters, 2022-2026
| Date | Target | Claimed scale | Status |
|---|---|---|---|
| 2022-2024 | Multiple retail and gaming firms (pre-2025) | Varies by incident | Attribution to ShinyHunters ecosystem, per court records cited by CybelAngel |
| May-June 2026 | Oracle PeopleSoft customers (100+ organizations) | ~300 instances, roughly 68% universities, per Picus Security | Vulnerability exploitation confirmed; full ShinyHunters attribution reported, not universally verified per-victim |
| August 2026 | Baxter International | 7.1 million records claimed | Hacker claim reported by Startup Fortune; no independent confirmation cited |
| September 22-23, 2026 | FBIjobs.gov / FBI personnel data | 2-3 TB claimed; sample of ~5,000 employees verified as partly authentic | FBI confirms investigation; full scope and source unconfirmed |
| September 25, 2026 | FBI staff medical/psychiatric records (claimed) | Unspecified volume | Reported as a group claim by Reuters; unverified |
| September 29, 2026 | N/A (law enforcement action) | 1 suspect apprehended in the Netherlands | Arrest confirmed by The New York Times; no conviction reported |
The Oracle PeopleSoft campaign is worth dwelling on, because it shows a different side of the group’s operations than the FBI incident does. It followed the same actors’ web application firewall bypass against PeopleSoft’s Environment Management component. Picus Security’s analysis of the CVE-2026-35273 exploitation wave found roughly 300 vulnerable PeopleSoft instances across more than 100 organizations, with universities accounting for an estimated 68% of affected victims, and Reuters reported that Google’s Mandiant tracked a renewed round of mass exploitation of the same Oracle PeopleSoft flaws in September 2026. That is mass, largely automated exploitation of a single enterprise software flaw, a very different technique from the personalized social-engineering calls the group is better known for. It suggests ShinyHunters, or whoever is operating under that name in 2026, has grown from a purely social-engineering crew into one that can also run vulnerability-driven campaigns at scale, with the Mandiant findings indicating that campaign was still active months after the initial May-June wave.
Inside the Playbook: Vishing, Extortion, and Cloud Abuse
The technique most consistently tied to ShinyHunters across its documented breaches is vishing, voice-phishing calls in which an attacker impersonates IT or help-desk staff to trick an employee into resetting credentials, approving a multi-factor authentication prompt, or reading out a one-time passcode. The FBI’s May 2026 advisory described this pattern directly and warned organizations that pay-outs only encourage further attacks, which is part of why ShinyHunters reportedly wanted the advisory pulled down.
The extortion model layered on top of that access typically follows a familiar sequence: steal data first, threaten public release on a leak site or through journalists, publish a small sample to prove the claim is real, then pressure the victim either to pay or, in rarer cases like the FBI incident, to take a specific public action. Sharing samples with outlets such as 404 Media and citing FBI advisories by name are both consistent with a group that treats media coverage itself as a lever, not just an unfortunate side effect of getting caught.
Security researchers frequently discuss ShinyHunters alongside Scattered Spider and Lapsus$, three loosely affiliated groups that share overlapping tactics: English-language social engineering, help-desk impersonation, cloud-credential theft, and public extortion. That does not mean the three names refer to one organization. Analysts generally describe them as overlapping ecosystems with shared personnel, aliases, or criminal contacts in some cases, rather than a single hierarchical gang, and no source reviewed for this piece establishes that every incident attributed to one label involves the same individuals as another.
ShinyHunters vs. Scattered Spider vs. Lapsus$
| Trait | ShinyHunters | Scattered Spider | Lapsus$ |
|---|---|---|---|
| Primary technique | Vishing, cloud credential theft, some vulnerability exploitation (e.g. PeopleSoft) | Help-desk social engineering, MFA fatigue, SIM swapping | Social engineering, insider recruitment, source-code theft |
| Extortion style | Data theft plus public leverage, occasionally non-monetary demands | Data theft, ransomware affiliations reported | Public leak-site shaming, no ransomware encryption typically used |
| Documented law enforcement action | 1 conviction (Raoult), multiple arrests without conviction reported | Multiple arrests reported across UK/US in prior years | Arrests reported in UK in prior years |
| Organizational structure | Described as an ecosystem/alias, not a fixed hierarchy | Described as a loose collective | Described as a loose collective, largely inactive by name since prior years |
The table above reflects publicly reported patterns rather than confirmed formal structures. Attribution in this space is genuinely difficult: the same alias can be used by different people over time, and researchers frequently caveat their own findings for that reason.
Arrests vs. Convictions: Getting the Legal Status Right
Coverage of ShinyHunters often blurs an important legal distinction, so it’s worth stating plainly who has actually been convicted versus who has simply been arrested or is under investigation.
- Sébastien Raoult (French national): arrested in Morocco in 2022, extradited to the United States, and convicted and sentenced to three years in prison, per CybelAngel. He is the clearest case of a finalized conviction tied to the ShinyHunters name.
- Four suspects arrested in France on June 25, 2025, using aliases including “ShinyHunters,” “Hollow,” “Noct,” and “Depressed”: arrested and under investigation. No conviction has been reported for any of the four.
- A 24-year-old suspect apprehended in the Netherlands on or around September 29, 2026: arrested on suspicion of assisting ShinyHunters-linked theft and extortion, per The New York Times. No charge outcome or conviction has been reported.
That pattern, one conviction against a backdrop of repeated arrests, is common in cybercrime cases involving loosely organized, pseudonymous groups. It also helps explain why the FBI’s public messaging has focused on investigation and pursuit rather than on naming a culprit: identifying who is behind a given claim, and proving it in court, are two very different bars to clear.
Why Target the FBI, of All Victims
Most ShinyHunters targets have been companies with something to lose financially: healthcare providers, retailers, cloud platforms. The FBI is a different kind of target. It cannot pay a ransom, and going after it invites the exact kind of sustained federal attention that has produced the group’s one confirmed conviction to date. According to Reuters, the group’s own stated logic was retaliatory: the bureau had published an advisory in May describing ShinyHunters’ methods and telling victims not to pay, and the group wanted that advisory gone.
There’s also a simpler explanation that runs alongside the retaliation narrative: attention. A claimed breach of the FBI generates coverage from national outlets in a way that a claimed breach of a mid-size logistics company never will, and for a group whose extortion model depends on media pressure, that kind of visibility has its own value even without a ransom payment attached. Whether the FBI incident produces new leverage over other, unrelated victims who fear the same treatment is one of the open questions security researchers are watching in the coming weeks.
Sample IOC Reference Format From the PeopleSoft Campaign
For readers responsible for enterprise PeopleSoft deployments, Picus Security’s reporting on the exploitation wave tied to the same broader ShinyHunters-linked activity references the following vulnerability identifier, which security teams should already have patched or mitigated:
CVE-2026-35273
Component: Oracle PeopleSoft Environment Management
Reported scope: ~300 instances / 100+ organizations
Sector concentration: ~68% higher education (per Picus Security)
Status: Patch available; exploitation reported May-June 2026Organizations that never audited PeopleSoft exposure after the May-June wave are worth a second look, given that the same actor ecosystem has now escalated to targeting a federal law enforcement agency.
Industry and Market Reaction
The FBI incident lands in a year that has already seen a steady drumbeat of ShinyHunters-linked disclosures tracked on our cybersecurity threats hub, from Oracle PeopleSoft customers to Baxter International. Each new claim adds to a threat-intelligence picture that vendors and insurers are increasingly building risk models around: identity-focused social engineering that bypasses traditional perimeter defenses, combined with opportunistic exploitation of widely deployed enterprise software. Security vendors that specialize in identity protection and help-desk verification have pointed to the group’s vishing techniques repeatedly this year as a reason large organizations need call-back verification and hardware security keys for privileged account resets, rather than SMS or app-based one-time codes alone.
For federal agencies specifically, the incident raises procurement and third-party risk questions that go beyond ShinyHunters. The FBI’s own acknowledgment that it isn’t yet sure whether the breach originated inside its enterprise network or through a third-party vendor supporting FBIjobs.gov highlights a persistent weak point across government IT: outsourced portals and recruiting systems often sit outside an agency’s core security monitoring, even when they collect sensitive personal data on employees and applicants.
Historical Context: From Encryption to Pure Extortion
ShinyHunters belongs to a broader shift in cybercrime that has been building since roughly 2023: attackers increasingly skip ransomware encryption altogether and go straight to data theft and extortion. Encrypting a victim’s systems is noisy, requires more technical infrastructure, and gives defenders a clear signal that something is wrong. Simply copying data out and threatening to publish it is quieter, harder to detect in real time, and just as effective at generating payment pressure, particularly when the stolen data includes medical records, Social Security numbers, or, as in the FBI case, information about law enforcement personnel and their families.
That evolution also explains why groups like ShinyHunters can operate with relatively small crews. Where a traditional ransomware operation might need malware developers, negotiators, and money-laundering infrastructure, a vishing-and-extortion operation mainly needs people who are good on the phone and patient enough to research a target’s internal jargon and org chart. That lower barrier to entry is part of why the same names, and the same overlapping affiliate pools, keep resurfacing across unrelated victims year after year.
What Happens Next: Five Predictions
- The FBI will eventually confirm a narrower scope than ShinyHunters’ claimed 2-3 TB. Extortion groups routinely inflate figures to maximize pressure, and the bureau’s own language already stops well short of endorsing that number.
- More arrests are likely, but a US conviction of a core FBI-breach suspect will take months, if not years. The Raoult case shows the timeline from arrest to sentencing can span roughly two years even in a relatively clean extradition case.
- Federal agencies will face new scrutiny over third-party recruiting and HR portals. The uncertainty over whether FBIjobs.gov was breached directly or through a vendor is likely to prompt broader audits of outsourced government portals.
- ShinyHunters, or affiliates using the name, will claim at least one more high-profile victim before the end of 2026. The group’s pace of disclosed claims this year, from PeopleSoft customers to Baxter International to the FBI, has not slowed.
- Expect continued blending of vishing and vulnerability exploitation. The PeopleSoft campaign shows the group, or its affiliates, are no longer relying on social engineering alone, and that hybrid approach is likely to keep expanding to other widely used enterprise platforms.
What This Means for Security Teams
For CISOs and IT leaders, the practical lesson from the FBI incident has less to do with the specific target and more to do with process. Help-desk verification procedures, hardware-based multi-factor authentication for privileged accounts, and strict controls on who can approve credential resets remain the most direct defenses against ShinyHunters’ documented tactics. Enterprises still running PeopleSoft or similar legacy enterprise platforms should treat the May-June exploitation wave as a reminder to confirm patch status rather than assume a single round of remediation closed the gap. And any organization that outsources recruiting, HR, or applicant-tracking systems to a third party should confirm exactly what personal data that vendor holds, and how it’s monitored, rather than assuming it falls outside the core security perimeter simply because it isn’t hosted internally.
Frequently Asked Questions
Is ShinyHunters the same group as Scattered Spider or Lapsus$?
No. Security researchers frequently discuss the three groups together because they share overlapping tactics, including vishing and cloud-credential theft, and may share some personnel or contacts. But available reporting does not establish that they are a single organization, and attribution for any individual incident should be treated separately.
Has the FBI confirmed its systems were hacked?
The FBI has confirmed it is investigating unauthorized activity affecting FBIjobs.gov and has acknowledged that employee personal information was exposed, according to The New York Times. It has not confirmed ShinyHunters’ claimed 2-3 terabyte data volume or the assertion that data on “almost all” agents was obtained.
Has anyone been convicted for the FBI breach specifically?
No. The Dutch suspect apprehended around September 29, 2026, has been arrested on suspicion of assisting ShinyHunters-linked theft and extortion, but no charges or conviction related to the FBI incident specifically have been reported.
Has any ShinyHunters-linked individual ever been convicted?
Yes. French national Sébastien Raoult was arrested in 2022, extradited to the United States, and convicted and sentenced to three years in prison, according to CybelAngel.
What is CVE-2026-35273 and how does it relate to this story?
It is the Oracle PeopleSoft Environment Management vulnerability exploited in a May-June 2026 campaign that Picus Security linked to roughly 300 instances across more than 100 organizations, primarily universities. It illustrates a separate, vulnerability-driven technique used by actors in the same ecosystem as the FBI-breach claims, distinct from the vishing methods more commonly associated with ShinyHunters.
Why did ShinyHunters say it targeted the FBI?
According to Reuters, the group said the attack was retaliation for an FBI advisory published in May 2026 that described ShinyHunters’ tactics and urged victims not to pay extortion demands. SecurityWeek reported the group demanded the FBI retract or remove that advisory.
Is the leaked FBI data real?
Some of it appears to be. The New York Times reported that cross-checking a sample obtained by 404 Media, covering roughly 5,000 employees, against publicly available information suggested at least part of the data was likely legitimate. That does not confirm the full scope, source, or total volume ShinyHunters has claimed.
What should organizations do in response to ShinyHunters’ tactics?
Security researchers and the FBI’s own May 2026 advisory recommend hardware-based multi-factor authentication for privileged accounts, strict call-back verification for help-desk credential resets, and regular audits of third-party vendors that handle employee or customer personal data.
Related
- Dutch Hacker Arrested in ShinyHunters Probe Tied to FBI Breach
- FBI Declares ‘Cyber Incident,’ 5,000 Agents Notified
- ShinyHunters Bypass WAF on CVSS 9.8 PeopleSoft Bug
- Rockstar Games Snowflake Breach: Inside the ShinyHunters’ Anodot Hack
- Oracle PeopleSoft Flaw Hits 100+ Schools, CVSS 9.8
Related Coverage
- Dutch Hacker Arrested in ShinyHunters Probe Tied to FBI Breach [2026]
- FBI Job Portals Stay Offline, ShinyHunters Claims 3TB Hit [2026]
- Managed SOC Services Explained: What They Do and Who Really Needs One
- FBI Confirms Breach: ShinyHunters Claims 2TB Stolen [2026]
- ShinyHunters Bypass WAF on CVSS 9.8 PeopleSoft Bug [2026]
