# ShinyHunters Claims Compromise of FBI Careers Portal The FBI confirmed it is investigating a breach of its job applications platform after the ShinyHunters cybercrime group defaced the FBIjobs.gov website on Tuesday. The group replaced images on the site with a Pokemon photo it uses as a mascot, posted a statement on its leak site and threatened to release records on FBI personnel and applicants unless the agency removed a public service announcement. News outlets verified samples of 5,000 FBI agent records provided by ShinyHunters. The special agent application portal remained offline Wednesday morning. ## Defacement and Data Samples ShinyHunters replaced agency branding on FBIjobs.gov with a photo of a Pokemon the group uses as a mascot. The defacement appeared on Tuesday. The group then published a statement on its leak site and threatened to release records of FBI personnel and job applicants. ShinyHunters provided samples of 5,000 FBI agent records to 404media and several other news outlets, which confirmed the records were legitimate. As of Wednesday morning the FBI jobs site displayed a banner stating the special agent application portal is unavailable. ## FBI Response and Investigation Status An FBI spokesperson told Recorded Future News on Tuesday that the agency is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating. The FBI did not respond to several other questions about the claims made by ShinyHunters. The agency has not stated how many records may have been exposed, how the attackers gained access or when the portal will be restored. ## Dispute Over FBI Public Service Announcement ShinyHunters posted a statement disputing claims in an FBI public service announcement issued in May. The May notice was released after ShinyHunters attacked educational software company Instructure, disrupting thousands of schools and forcing the company to pay a ransom. The group denied FBI assertions that it had exaggerated data claims, conducted swatting attacks or threatened victims' families. ShinyHunters also denied being sextortionists or part of The Com, a group accused of targeting children online. ## FBI Focus on the Group Brett Leatherman, assistant director of the FBI Cyber Division, discussed ShinyHunters at a media roundtable two weeks ago. He said the FBI is focused on the group because of data exfiltration and extortion attacks. ShinyHunters has attacked Ticketmaster, AT&T, McGraw Hill, Carnival Cruise Line, 7-Eleven and other companies. The FBI has been investigating the group for nearly a year and recently secured arrests of members of a related cybercrime group. ## Potential Risks From Leaked Records Andrew Brandt of cybersecurity firm Huntress said the concern is that ShinyHunters could sell the data to other criminal or nation-state groups who could put it to more damaging use. FBI personnel deal with serious and dangerous criminals, sometimes requiring infiltration into criminal networks. The data could be abused for financial fraud, threats of harm against staff and their families, or future targeted attacks in cyberspace or the physical world. Several experts said it is likely the group will leak the data because the FBI will not remove the alert. ## Steps for Affected Individuals Anyone who applied for an FBI job through the platform should take precautions. Freeze credit reports with the three major credit bureaus to prevent unauthorized accounts. Enable two-factor authentication on all online accounts, including email and financial services. Watch for phishing emails or calls requesting verification or personal information. Report any suspicious contact or targeting attempts to the FBI security office. Do not respond to unsolicited messages asking for additional information. 1. Freeze credit reports with the three major credit bureaus to prevent unauthorized accounts. 2. Enable two-factor authentication on all online accounts, including email and financial services. 3. Watch for phishing emails or calls requesting verification or personal information. 4. Report any suspicious contact or targeting attempts to the FBI security office. 5. Do not respond to unsolicited messages asking for additional information. ## What did ShinyHunters claim to have stolen from the FBI jobs site? ShinyHunters claimed to have stolen information on current and former FBI employees and applicants. The group provided samples of 5,000 FBI agent records to news organizations, which confirmed the records were legitimate. The FBI has not stated how many records may have been exposed. ## Why did ShinyHunters target the FBI jobs platform? ShinyHunters posted a statement disputing claims in an FBI public service announcement issued in May. The group threatened to leak FBI personnel and applicant data unless the FBI removed that alert. The May notice asserted the group had exaggerated its breaches and conducted swatting and threats, which ShinyHunters denied. ## Will ShinyHunters release the full dataset? Several experts said it is likely ShinyHunters will leak the data because the FBI will not remove the public service announcement. Andrew Brandt of Huntress said the greater concern is that the group might sell the data to other criminal organizations or nation-state actors. ## What can FBI applicants do if their information was exposed? Applicants should freeze credit reports with the three major bureaus, enable two-factor authentication on all accounts, watch for phishing emails and calls, and report any suspicious contact to the FBI security office. Do not respond to unsolicited messages asking for verification or additional information. ## What is ShinyHunters known for? ShinyHunters is a cybercrime group that has attacked Ticketmaster, AT&T, McGraw Hill, Carnival Cruise Line, 7-Eleven and other companies. Brett Leatherman, assistant director of the FBI Cyber Division, said the FBI is focused on the group because of data exfiltration and extortion attacks. The FBI has been investigating ShinyHunters for nearly a year. Source: The Record Published: 2026-09-24T00:27:36+00:00