On September 22, a hacking crew called ShinyHunters posted on its leak site that it had breached the FBI. The claim was specific: names, home addresses, and phone numbers for “almost all” FBI agents and for everyone who had applied for a job at the bureau, plus the same for their spouses. The FBI’s first response said it was “aware of claims” and investigating. Four days later, according to reporting by TechCrunch, the bureau told its own employees in an internal notice that it was dealing with a “cyber security incident.” As of this writing it has not said so in public. The two portals through which Americans apply to become FBI agents remain offline.
What follows is what can be established from the public record about what was taken, how, who it endangers, and where responsibility sits. The short version is that the hole was known, the fix was available for three months, the group that used it is not considered sophisticated, and the bureau that failed to close it had spent the previous year and a half firing and reassigning the people whose job was to see this coming.
What was taken
The breached system was the Oracle PeopleSoft server behind FBIJobs.gov, the human-resources platform that stores recruitment and personnel data. ShinyHunters claims two to three terabytes. To prove it, the group handed roughly 5,000 records to journalists at Nextgov/FCW, who verified them. The fields are the problem. The records include names, home addresses, phone numbers, and Social Security numbers. They include details on spouses and siblings. They include job titles specific enough to identify intelligence analysts assigned to Russia, China, Hezbollah, and the cartels; personnel in human-intelligence collection, electronic surveillance, and telecommunications interception; and members of two units the bureau does not advertise, the Remote Operations Unit, which builds and runs the FBI’s computer-intrusion tools, and the FISA Management Unit, which handles applications for foreign-intelligence surveillance warrants. For applicants, the trove reportedly includes the medical and psychiatric screening that comes with applying to carry a badge: blood and urine results, psychological evaluations.
A former FBI agent and cybersecurity officer, Adam Marrè, told Nextgov the data enables “phishing, fraud, social engineering and further attacks on employees,” and beyond that, “counterintelligence efforts that could damage sensitive operations.” Another expert compared it to the 2015 breach of the Office of Personnel Management and said “the full counterintelligence impact will likely never be known.” The comparison is the right one and it is worth being exact about why.
Why it is dangerous, and for whom
The OPM breach, attributed by the U.S. government to China, took the security-clearance files of 21.5 million people. Those files were never posted on the internet, and their value lay elsewhere: in the ability, for a decade afterward, to know exactly who in the American government held which clearance, what they had disclosed about their debts and their relatives and their foreign contacts, and where they lived. That is a targeting database, and a hostile service uses it the way a sales team uses a lead list: to decide whom to approach, with what, and through whom.
The FBI data is a narrower list and a sharper one. A single record does something specific when it combines a job title in the Remote Operations Unit with a home address, a spouse’s name, and a sibling’s phone number. The agent may never have appeared publicly as FBI. Most do not. Now a foreign service, or a cartel, or a man with a grievance and an internet connection, knows the agent’s role, the agent’s front door, and the two people the agent would do almost anything to protect. The risk runs in three directions at once. Recruitment: the record identifies who has access worth buying and what pressure points exist. Coercion: psychiatric screening results and family details are the raw material of leverage. Violence: the bureau’s own counterintelligence people have spent years documenting Iranian assassination plots against U.S. officials on American soil, and Mexican cartels do not need a briefing on what to do with the home address of the agent who works their case.
The families are the part that gets lost in the word “agents.” Spouses and siblings never applied for a job at the FBI; they are in the data because the bureau collects them, and they are now exposed to whatever the agent is exposed to, without the training, the weapon, or the badge.
Then there are the applicants, tens of thousands of people who never got the job, or have not yet, whose Social Security numbers and medical histories were sitting on the same server. They have no counterintelligence protection and no employer to notify them. Some of them are twenty-three.
ShinyHunters has since said it will never publish the data and described its earlier demands, including a seven-day deadline, as “a marketing campaign.” What it wanted, it says, was for the FBI to retract a public advisory the bureau’s Internet Crime Complaint Center issued on May 15, warning the country about ShinyHunters. Even taken at its word, the group’s promise shrinks none of the danger. It has not said the data was deleted. It has already distributed samples. And ShinyHunters is a loose criminal collective with a documented history of selling what it steals; the promise of one faction binds nobody. The relevant question is who will hold this data in a year, and the answer, based on every comparable case, is anyone who wants it badly enough to pay.
The China angle, stated precisely
Every available piece of evidence points to ShinyHunters, a crew the Daily Beast described as “not regarded as a particularly sophisticated group,” rather than to China, and the distinction matters for two reasons. The first is that China does not need to have done it to benefit; a targeting list of FBI counterintelligence personnel is worth more to the Ministry of State Security than to anyone else on earth, and the market for it now exists. The second is that China had already been inside the FBI this year. On February 17, the bureau detected anomalous activity on an unclassified system holding pen-register and trap-and-trace data, the metadata records of whom the FBI’s surveillance targets were calling. The Wall Street Journal reported a suspected Chinese nexus, with similarities to the 2024 Salt Typhoon campaign in which Chinese operators sat inside American telecom networks’ lawful-intercept systems. The Justice Department declared it a “major incident” under federal law and notified Congress. What that system reveals is the inverse of the September breach: the FBI’s targets rather than the FBI’s people, which tells a foreign service which of its own assets have been found.
Two intrusions in seven months, then. One reportedly by a state that wants to know whom the bureau is hunting. One by amateurs who took the list of the hunters. Together they are the two halves of a counterintelligence map.
How it happened
The technical story is short and it is the center of the accountability question. The vulnerability, tracked as CVE-2026-35273, is a flaw in Oracle PeopleSoft. Mandiant documented ShinyHunters exploiting it as a zero-day against universities in June. Oracle released a patch on June 10 and, alongside it, an explicit warning: relying on web-application-firewall rules to block the attack was “insufficient, as these controls can be bypassed.” Some organizations applied the patch. Others wrote a firewall rule to block the known attack string and moved on. ShinyHunters then found that URL-encoding a single character in the request defeated the firewall rule while the unpatched server behind it processed the request normally. Every organization that had patched was protected. Every organization that had relied on the firewall rule was open. On September 22, the FBI’s hiring portal was open.
That is a three-month gap between a vendor patch, with a vendor warning attached, and a breach that used exactly the bypass the warning described. The FBI is the agency that investigates this category of crime for the rest of the country. Its own Internet Crime Complaint Center had published an advisory about this specific group four months earlier. The people who wrote that advisory worked in the same building as the people responsible for the server.
Why Kash Patel’s name belongs on this
A director answers for whether an agency of 38,000 people has the staff and the priorities to patch its servers, and on that question the record of the past eighteen months is unusually well documented, because Congress kept writing it down.
In September 2025, at a Senate Judiciary oversight hearing, Senator Dick Durbin told Patel that his office had been informed the Cyber Division was being cut “by half.” Patel called the cyber branch one of the bureau’s “most impressive” units, cited arrest statistics, and, when Senator Mazie Hirono asked him to name the officials who had replaced the ones he removed, refused, saying it would let critics “attack them.” In November, Senator Mark Warner, the vice chair of the Intelligence Committee, took the Senate floor to list the senior officials Patel had forced out, among them Michael Nordwall, who ran the bureau’s Criminal Cyber Response Branch, and to cite figures showing that between 25 and 45 percent of the agents handling counterterrorism, cyber, and espionage cases had been reassigned to immigration enforcement. In early March of this year, days before the strikes on Iran, Patel fired about a dozen agents and staff specializing in counterespionage, several with Iran expertise; the ranking Democrats on the House Homeland Security Committee wrote to him that the firings had undermined the bureau’s ability to counter foreign threats and asked him to appear. Matthew Olsen, who ran the Justice Department’s National Security Division, said the administration had “forced out, fired, the most capable, the most experienced” people working the Iran threat. A retired senior FBI official, Frank Montoya, put it more plainly: “So much experience has been decimated from the ranks.”
Set that record against the breach. The director cut the division whose job is to know what ShinyHunters is doing this month. He removed the head of the branch that responds to criminal cyber intrusions. He moved a quarter to nearly half of the cyber and espionage workforce onto immigration cases. He fired counterespionage agents in the same weeks the bureau was cleaning up a suspected Chinese intrusion into its surveillance data. And when his own agency’s vendor shipped a patch in June with a warning that the shortcut would not hold, nobody applied it for three months, until a group the bureau had already named in a public advisory used the shortcut the warning described.
There is one more entry. On March 27, an Iran-linked group called Handala announced it had broken into Patel’s personal email accounts, and Reuters and CNN confirmed it through security officials. The correspondence and photographs taken went back more than a decade. Whatever one makes of a director’s private accounts, the head of the FBI was personally compromised by a foreign-linked crew six months before his agency’s personnel files were taken by a domestic one. The bureau has not publicly addressed either in any detail. Agents quoted anonymously since the September breach have used the phrases “sloppy and lazy” and “leadership is lost,” and one former agent said only: “This is really bad for our undercover agents.”
What accountability would look like
The bureau owes three things it has not yet provided. A public confirmation of what was taken, so that the people in the data, and their families, can act on it instead of reading about it in TechCrunch. An explanation of why a patch issued in June was not applied by September to a system holding the identities of counterintelligence personnel. And an accounting, under oath, of what happened to the Cyber Division’s headcount and leadership between February 2025 and now, because the senators who asked that question a year ago were told the division was impressive, and the answer has since arrived on a leak site.
All of this stands without believing a word ShinyHunters says; it rests on the vendor’s patch date, the bureau’s own advisory, the Senate record, and 5,000 verified records with home addresses in them. The people whose names are in those records spent their careers learning how foreign services build a target list. They are now on one, assembled at no cost, by a group the bureau had already identified, through a door the bureau had been told to close.
This shows the lack of experience, or care, Kash Patael has for his job. He is centered around immigration while neglecting the ever-growing cyber networks that can undermine our security much worse than any band of illegal immigrants could. Since he has been asked to appear before the committees, and he refuses to answer questions, he should be impeached (for this reason alone, although there are many more cases). This administration has no regard for the American people and their safety, only their pockebooks.
We are so vulnerable in so many ways and this administration is too inept and lazy to do anything about it. Let me count the ways: elections are exposed, banking systems, utilities and now the fbi. Just ask yourself how many times that your personal information has been exposed. They’re talking AI, like a bunch of big spenders, but they cannot even protect the systems in place. The incompetence is killing me folks!