The Federal Bureau of Investigation has reportedly told employees that their personal information was stolen in a cyberattack involving its job application portal. An internal notice described the breach as a “cyber security incident” and said exposed information included names, addresses, job titles, and Social Security numbers.
The notification marks the FBI’s first reported acknowledgment to employees that their data was taken. In a September 23 statement, the bureau said it was investigating claims involving FBIJobs.gov but had not yet determined whether the breach occurred through an FBI system or a third-party provider.
Medical and Personnel Records Were Among the Data
Media reports have since indicated that the stolen information included medical records involving blood and urine samples, psychiatric evaluations, prescriptions, and other health information. Reuters reported that some records reviewed by the news organization contained details from fitness-for-duty examinations and mental health evaluations.
The hacking group ShinyHunters previously claimed it had obtained information covering a large portion of FBI personnel, as well as a substantial amount of data belonging to applicants who used FBIJobs.gov. The group reportedly exploited a vulnerability in an Oracle PeopleSoft server used to store human resources information.
ShinyHunters told TechCrunch that it was not seeking a financial ransom. Instead, the group demanded that the FBI correct an earlier report that the hackers said misrepresented their activities.
National security expert Justin Sherman described the breach as a “counterintelligence disaster” in a Lawfare post. He warned that stolen personnel information could expose FBI employees to profiling, phishing attempts, and approaches from foreign intelligence services.
Congressional Disclosure Remains Unclear
It remains unclear whether the FBI has formally notified lawmakers who oversee the bureau. Federal rules require agencies to report a cyberattack to Congress when it qualifies as a “major incident,” including breaches involving personally identifiable information that could cause demonstrable harm to U.S. national security.
If the incident meets that threshold, it would become the FBI’s second known data breach notification to lawmakers this year. Earlier in 2026, hackers suspected of links to China breached a surveillance system and exposed information related to FBI surveillance targets and investigations.
A White House spokesperson referred questions about whether the breach had been declared a major incident to the FBI. The bureau did not respond to a request for comment on Monday, while representatives for several lawmakers with FBI oversight responsibilities did not provide immediate answers.
The FBI job site, which ABC News reported has been the main route for bureau job applications since 2017, remained offline at the time of reporting.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.