ShinyHunters told 404 Media that it had data on FBI employees and applicants, and the outlet reported reviewing a sample said to contain personal information. That report documented the group’s claim and the sample it saw; it did not establish that the sample represented every FBI employee or applicant.
On September 23, the FBI issued a statement acknowledging a cybercriminal group’s claim that fbijobs.gov had been compromised and that employee personally identifiable information may have been affected. The FBI said the point of breach—whether a third-party provider or the FBI’s own enterprise—was still undetermined, and that it was investigating with providers supporting the jobs portal.
The image identifies the agency that says it is investigating the portal compromise claim; it does not depict the affected system or stolen data.
That update changes what can responsibly be said. The portal compromise is no longer only an allegation reported by a news outlet: the FBI itself says it is investigating the claim. But the agency did not confirm the attackers’ claimed dataset, the number of people affected, or that information on every employee and applicant had been taken. “The FBI is investigating a claimed compromise” is therefore more accurate than “hackers stole all FBI employee data.”
The distinction matters because the leaked material’s scope and authenticity determine the risk to people named in it. Until investigators establish what system was accessed and validate the data, the group’s statement and a reported sample cannot answer those questions. The FBI’s public statement gives no technical account of the intrusion or final findings. This article therefore reports the confirmed investigation and keeps the extent of any exposure unresolved.