Shiny Hunters breaches FBI portal exposing agent files

An extortion syndicate breached an FBI personnel system and walked away with internal blueprints for foreign counterintelligence.

Hackers exploited a zero-day vulnerability in an Oracle PeopleSoft tool integrated into a federal job portal. On The Daily, reporter Dustin Volz detailed how intruders compromised names, home addresses, phone numbers, and internal job titles belonging to current and former personnel. The breach mapped out internal reporting structures, exposing agents assigned to counter foreign intelligence threats from China and Russia.

For an agency where personnel routinely purge public records to protect their families, the leak dismantles decades of operational security. The stolen files also included names and contact information for agents' spouses and children, leaving entire households vulnerable to targeted harassment or foreign surveillance.

The intrusion was not the work of state-backed spies, but a syndicate of youth extortionists operating under the banner Shiny Hunters. On The Daily, Volz reported that the group claimed the attack was retaliation for an FBI public warning that linked them to swatting and harassment campaigns.

After sending sample files to prove their access, the syndicate threatened a full public release unless the bureau retracted its public statements. But the extortion campaign stalled abruptly. The hackers announced they would hold back the data shortly after Dutch National Police arrested a 24-year-old alleged leader in the Netherlands.

The arrest halted immediate public publication, but it did not recover the stolen files. The intact database remains missing, creating an ongoing intelligence risk if the group decides to sell the agent directories directly to hostile foreign services.