Reported by 25 outlets

Timeline

1. original reporting

   Reuters: ShinyHunters hackers say they stole psychiatric and medical records of FBI staff. “FBI personnel data recently stolen by the ShinyH

   rbfirehose.com · 16d ago · September 27th, 2026

   Reuters: ShinyHunters hackers say they stole psychiatric and medical records of FBI staff. “FBI personnel data recently stolen by the ShinyH

   via Mastodon https://rbfirehose.com/2026/09/27/reuters-shinyhunters-hackers-say-they-stole-psychiatric-and-medical-records-of-fbi-staff/

2. update from ic3.gov

   ShinyHunters: Cyber Criminal Group Attacks Learning Management System (IC3 PSA I-051526-PSA)

   ic3.gov · 152d ago · May 15th, 2026

   The FBI's Internet Crime Complaint Center warned that ShinyHunters attacked an online Learning Management System used by educational institutions and described the group's pressure tactics, including harassment, swatting, and false claims of possessing compromising material. This May 15 PSA is the report ShinyHunters later demanded the FBI withdraw or correct, making it the stated motive for the FBI job portal intrusion.

3. update from cisa.gov

   CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-35273)

   cisa.gov · 124d ago · June 12th, 2026

   CISA added the exploited Oracle PeopleSoft vulnerability CVE-2026-35273 to the Known Exploited Vulnerabilities catalog on June 12, 2026, two days after Oracle's patch release. The listing formalized that the flaw was under active attack and set federal remediation deadlines.

4. update from heise.de

   Cybergang ShinyHunters attackiert Oracle-PeopleSoft-Schwachstelle

   heise.de · 120d ago · June 15th, 2026

   Early coverage tying ShinyHunters to active attacks on the newly patched PeopleSoft flaw, citing Mandiant's finding that the group targeted PSEMHUB environment management endpoints worldwide. Recommended mitigations included restricting /PSEMHUB/* and /PSIGW/HttpListeningConnector to internal addresses, treating WAF rules as insufficient, and watching outbound traffic on port 445.

5. update from reuters.com

   ShinyHunters hackers say they breached Federal Bureau of Investigation

   reuters.com · 22d ago · September 22nd, 2026

   First news coverage of the claim: on Tuesday, September 22, ShinyHunters said it breached the FBI jobs portal at fbijobs.gov, citing anger over the FBI report that groups victims into sextortion categories and demanding retraction or correction within a week. Reuters matched sample records against credit bureau and prior leak data, with at least 10 matching including Director Kash Patel, and noted the samples carried names, home addresses, Social Security numbers, and duty assignments.

6. update from theregister.com

   ShinyHunters claims FBI hack: 'This is NOT financially motivated'

   theregister.com · 21d ago · September 22nd, 2026

   The group described an Oracle PeopleSoft pre-auth zero-day giving remote code execution on the jobs portal at apply.fbijobs.gov, a claimed 2 TB to 3 TB haul covering current, former, and prospective employees, and lateral movement onto FBI-managed AWS GovCloud servers with access to HR, MedLink, and CJIS services. ShinyHunters demanded the FBI retract its May 2026 FLASH report and defaced the jobs site with a 'This site has been seized by ShinyHunters' message.

7. update from cbs4local.com

   High profile hacking group claims it hacked the FBI and stole data on employees

   cbs4local.com · 21d ago · September 22nd, 2026

   The National News Desk reported the FBIjobs.gov defacement reading 'this site has been seized by ShinyHunters' and a 'System Unavailable' state on September 22, plus the group's statement that PII and PHI on incumbent and former employees and all applicant information was compromised. A group representative described the operation as coercion rather than extortion. The FBI had not responded at publication.

8. update from reuters.com

   Exclusive: Hacked FBI data has sensitive information about employees' intelligence roles

   reuters.com · 21d ago · September 23rd, 2026

   Reuters examined a 5,000-line spreadsheet said by the hackers to be a small piece of a claimed two to three terabyte trove. It lists names, addresses, phone numbers, dates of birth, Social Security numbers and emergency contacts, plus assignments to specific field offices and units doing intelligence, security or counterespionage work.

9. update from malwarebytes.com

   ShinyHunters claims FBI breach was revenge for 'false' report

   malwarebytes.com · 21d ago · September 23rd, 2026

   Analysis of the ShinyHunters leak-site PSA addressed to FBI Cyber Division Assistant Director Brett Leatherman and Director Kash Patel, demanding removal of the Q2 2026 FLASH report within one week and claiming compromise of Criminal Justice, HR and Medlink services. The post identifies the grievance target as the FBI/IC3 PSA260515 issued May 15, 2026, and cites 404 Media's verification of a roughly 5,000-agent sample.

10. update from 404media.co

    FBI Hack Exposed FBI's Own Hacking Unit

    404media.co · 20d ago · September 23rd, 2026

    Joseph Cox reports that the stolen personnel data includes members of the FBI's Remote Operations Unit, the secretive team that builds exploits and covert-access tools, potentially revealing who is in the unit, and frames the trove as valuable to criminals and foreign intelligence agencies. The full post is paywalled. Exact timestamp taken from the site's RSS feed pubDate.

11. update from heise.de

    Cybergang ShinyHunters behauptet Einbruch in FBI-Jobportal

    heise.de · 19d ago · September 24th, 2026

    Second-day coverage noting the ShinyHunters leak site no longer listed the FBI entry, the jobs portal remained offline, and an FBI statement left open whether the attackers hit a third party or FBI systems. It also recorded the group's reference to the May 2026 IC3 report as the trigger and its one-week ultimatum.

12. update from www.npr.org

    FBI investigating after hackers say they took sensitive data from agency's jobs site https://www.npr.org/2026/09/24/nx-s1-5979037/fbi-invest

    www.npr.org · 19d ago · September 24th, 2026

    FBI investigating after hackers say they took sensitive data from agency's jobs site https://www.npr.org/2026/09/24/nx-s1-5979037/fbi-invest

    via Mastodon https://www.npr.org/2026/09/24/nx-s1-5979037/fbi-investigating-after-hackers-say-they-took-sensitive-data-from-agencys-jobs-site

13. update from reuters.com

    ShinyHunters hackers say they stole psychiatric and medical records of FBI staff

    reuters.com · 19d ago · September 25th, 2026

    This extended the known exposure beyond identity and staffing data to protected health information, two days before the story was picked up by the tracked feed.

14. update from google.com

    ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

    google.com · 19d ago · September 25th, 2026

    Mandiant and GTIG reported renewed mass exploitation of CVE-2026-35273 by UNC6240 with expanded targeting across education, technology, healthcare, agriculture, transportation, and government, specifically hitting organizations that applied WAF rules but did not patch. The bypass requests /%50SEMHUB/ instead of /PSEMHUB/, defeating literal path-matching WAF rules; the post documents x.jsp and u.jsp web shells, the SIDEEYE backdoor delivered via a trojanized EV-signed Ple64.exe installer, Neo-reGeorg tunnels, MeshCentral agents, and C2 at 162.219.30.165 on TCP 3333 and 3334.

15. mentioned by meterpreter.org

    The FBI ShinyHunters breach may expose staff of the FBI's Remote Operations Unit hacking team, via a claimed Oracle PeopleSoft zero-day. FBI

    meterpreter.org · 18d ago · September 25th, 2026

16. update from www.darkowl.com

    (darkowl.com) ShinyHunters Claims Breach of FBI Recruitment Data, Escalates Extortion Tactics with Non-Financial Demands In brief - This art

    www.darkowl.com · 18d ago · September 25th, 2026

    (darkowl.com) ShinyHunters Claims Breach of FBI Recruitment Data, Escalates Extortion Tactics with Non-Financial Demands In brief - This art

    via Mastodon https://www.darkowl.com/blog-content/fbi-allegedly-hacked-by-shinyhunters/

17. mentioned by justpaste.in

    ShinyHunters hackers say they breached FBI, stole data on bureau employees ShinyHunters says it targeted the FBI in response to a May 2026 a

    justpaste.in · 16d ago · September 27th, 2026

18. update from www.malwarebytes.com

    FBI agents’ blood tests and doctors’ notes surface after breach https://www. malwarebytes.com/blog/data-bre aches/2026/09/fbi-agents-blood-t

    www.malwarebytes.com · 15d ago · September 28th, 2026

    FBI agents’ blood tests and doctors’ notes surface after breach https://www.

19. update from cyberscoop.com

    ShinyHunters trades financial extortion for a reckless war of ego with the FBI

    cyberscoop.com · 15d ago · September 28th, 2026

    Threat hunters and researchers are alarmed by what they’ve seen in data ShinyHunters claims it stole from the FBI . Limited samples of the stolen data contain FBI agents’ personal contact information, details on family members, office and duty assignments and, in some cases, information on agency personnel specialties, multiple sources said. “I am gravely concerned about the implications it opens up,” a researcher who has viewed and studied a sample of the data told CyberScoop. “It’s a roadmap for every s—y country, and drug cartel, and insane person to locate exactly who in the FBI they have a grievance with, and show up at their home or attack a person close to them,” the researcher who requested and was granted anonymity to share sensitive information added. The FBI jobs site, which was temporarily defaced by ShinyHunters, remains offline as of Monday. The FBI hasn’t confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly. The agency said it is “actively and aggressively investigating” the incident, the root cause and its alleged impact to FBI employees’ personally identifiable data in a statement Wednesday. Stolen data puts FBI agents at serious risk While the full scope of the attack remains under investigation, cybercrime experts are startled by the potential counterintelligence exposure a

20. update from krebsonsecurity.com

    Dutch Police Arrest 'Reformed' Hacker in Shiny Hunters Investigation

    krebsonsecurity.com · 15d ago · September 28th, 2026

    KrebsOnSecurity identified the arrested 24-year-old as Pepijn van der Stap, previously convicted in 2023 as Umbreon and detained on or around September 16, days before the group escalated with the FBI breach and the extortion of Cl0p. The piece links the group's risky pivot to new leadership under a teenager known as Rey of ScatteredLapsussHunters, cites a Mandiant estimate that ShinyHunters is on track for nearly 100 million dollars in 2026 extortion payments, and notes the suspect was due before the Rotterdam District Court on September 29.

21. update from theregister.com

    ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

    theregister.com · 15d ago · September 28th, 2026

    Like any other business: “It’s a game and it’s the world we live in,” a ShinyHunters spokesperson told us. “We are just protecting our business as any other business would do. It’s about who does their job better.” submitted by /u/Much_Preparation_832 [link] [comments]

    via reddit r/cybersecurity: ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

22. update from www.nytimes.com

    Embarrassing Breach at F.B.I. Fuels Fears of Harm to Its Employees https://www.nytimes.com/2026/09/28/us/politics/fbi-shinyhunters-damage.ht

    www.nytimes.com · 15d ago · September 28th, 2026

    Embarrassing Breach at F.B.I. Fuels Fears of Harm to Its Employees https://www.nytimes.com/2026/09/28/us/politics/fbi-shinyhunters-damage.ht

    via Mastodon https://www.nytimes.com/2026/09/28/us/politics/fbi-shinyhunters-damage.html

23. update from www.nytimes.com

    This may be one of the WORST government data breaches EVER. And it hit the FBI. Hackers say they stole home addresses, SSNs and secret job a

    www.nytimes.com · 15d ago · September 28th, 2026

    This may be one of the WORST government data breaches EVER. Hackers say they stole home addresses, SSNs and secret job a

    via Mastodon https://www.nytimes.com/2026/09/28/us/politics/fbi-shinyhunters-damage.html?unlocked_article_code=1.ElE.QKBb._-ERvf2OSy_o&smid=nytcore-ios-share

24. mentioned by www.nytimes.com

    Think about the impact of this: "In an internal memo, the F.B.I. said it believed the hackers may have stolen sensitive information on ALL o

    www.nytimes.com · 15d ago · September 28th, 2026

25. update from malware.news

    ShinyHunters says it won’t publish FBI data

    malware.news · 15d ago · September 28th, 2026

    The ShinyHunters cybercriminal group said Monday it does not intend to publish troves of sensitive FBI employee data it claims to have stolen, describing its confrontation with the bureau as a “marketing campaign” after demanding last week that the agency retract a public warning about its tactics. “Since the very beginning we had made our decision that we would never publish this data. We have never intended to nor have we ever planned to,” the group said in an email to Nextgov/FCW . The assertion leaves unresolved questions about the full scope of the intrusion and the risks to employees whose personal information may be already outside the bureau’s control. It accused news outlets and the public of misinterpreting its earlier demand that the FBI correct or remove an advisory within a week. It said it had deliberately left unspecified what would happen if the bureau did not comply, and claimed it had never expected compliance. It may hav

26. update from hackread.com

    📢 Exclusive: ShinyHunters tells Hackread it will not publish or sell the FBI data it claims to have stolen when its ultimatum ends, saying a

    hackread.com · 15d ago · September 28th, 2026

    📢 Exclusive: ShinyHunters tells Hackread it will not publish or sell the FBI data it claims to have stolen when its ultimatum ends, saying a

    via Mastodon https://hackread.com/exclusive-shinyhunters-fbi-data-wont-be-leaked/

27. mentioned by thedemocracyadvocate.com

    FBI Data Breach Claims Raise Safety Fears on Patel’s Watch The FBI data breach claimed by ShinyHunters may expose agents' home addresses and

    thedemocracyadvocate.com · 15d ago · September 29th, 2026

28. update from thedemocracyadvocate.com

    Hackers claim they took names, home addresses and spouse details on thousands of FBI agents. The FBI confirms it is investigating, and secur

    thedemocracyadvocate.com · 15d ago · September 29th, 2026

    The FBI confirms it is investigating, and secur

    via Mastodon https://thedemocracyadvocate.com/trump-watch/fbi-data-breach/

29. mentioned by thedemocracyadvocate.com

    Hackers claim they took names, home addresses and spouse details on thousands of FBI agents. The bureau is investigating, and the safety sta

    thedemocracyadvocate.com · 15d ago · September 29th, 2026

30. mentioned by malware.news

    FBI Hackers Say They Won’t Publish Massive Trove of FBI Employee Data

    malware.news · 14d ago · September 29th, 2026

31. mentioned by www.cnn.com

    Operators, now is the time to review counterintelligence exposure and actively monitor for misuse of any stolen personal data across prior b

    www.cnn.com · 14d ago · September 29th, 2026

32. update from www.heise.de

    ShinyHunters still active: details of the FBI data theft

    www.heise.de · 14d ago · September 29th, 2026

    Reuters compared sample records with other databases and judged them plausible, and the BBC reviewed samples from FBI agent health screenings that included blood and urine test results and specific allergy information. Further data includes full names and addresses, exposing agents to fraud, blackmail, and targeted attacks, and could be used to forge law-enforcement identities. Over the weekend Google's Mandiant renewed its warning that ShinyHunters is mass-exploiting the PeopleSoft vulnerability worldwide, bypassing Web Application Firewall rules with URL encoding such as /%50SEMHUB/ instead of /PSEMHUB/. Organizations that have not yet applied the June patches for CVE-2026-35273 (CVSS 9.8, critical) will find protective guidance in Mandiant's analysis. The report also notes a possible motive shift: Dutch police arrested a 24-year-old suspected of involvement in ShinyHunters data theft and extortion. He had been convicted in 2023 under the handle "Umbreon" for multiple data thefts and extortion attempts earning 1.5 to 2.7 million euros, received a four-year sentence with one year suspended, and was released in December 2025 before being arrested again in mid-September. Dutch investigators had also sought help identifying a Dutch-speaking caller who socially engineered his way into mobile provider Odido in February 2026, a breach that exposed data on more than 6.2 million Dutch citizens.

33. mentioned by www.nytimes.com

    F.B.I. Vows to Pursue ShinyHunters Hackers After Personnel Data Theft https://www.nytimes.com/2026/09/29/us/politics/fbi-hackers-shinyhunter

    www.nytimes.com · 14d ago · September 29th, 2026

34. mentioned by www.nytimes.com

    What to Know About the Hacking Group ShinyHunters and Its F.B.I. Breach https://www.nytimes.com/2026/09/29/us/politics/shinyhunters-fbi-hack

    www.nytimes.com · 14d ago · September 29th, 2026

35. mentioned by www.nytimes.com

    What to Know About the Hacking Group ShinyHunters and Its F.B.I. Breach https://www.nytimes.com/2026/09/29/us/politics/shinyhunters-fbi-hack

    www.nytimes.com · 14d ago · September 29th, 2026

36. mentioned by www.reuters.com

    The FBI is investigating claims that the cyber extortion group ShinyHunters breached FBIJobs.gov and stole sensitive information belonging t

    www.reuters.com · 14d ago · September 29th, 2026

37. update from www.reuters.com

    WTF - FBI official tells hackers to get in touch, says 'we know how to find you' By Raphael Satter and A.J. Vicens https://www. reuters.com/

    www.reuters.com · 14d ago · September 29th, 2026

    WTF - FBI official tells hackers to get in touch, says 'we know how to find you' By Raphael Satter and A.J. Vicens https://www.

38. update from dlvr.it

    FBI Data Breach: What Hackers Took From Agents http:// dlvr.it/TVj1Xn # criminaljustice # cybersecurity # donaldtrump # FBI

    dlvr.it · 14d ago · September 29th, 2026

    FBI Data Breach: What Hackers Took From Agents http:// dlvr.it/TVj1Xn # criminaljustice # cybersecurity # donaldtrump # FBI

    via Mastodon http://dlvr.it/TVj1Xn

39. mentioned by www.nytimes.com

    “The theft by a criminal hacking group of reams of sensitive personal data involving potentially tens of thousands of former and current F.B

    www.nytimes.com · 14d ago · September 29th, 2026

40. update from zubiqo.com

    The FBI is dropping threat videos aimed at ShinyHunters after Dutch police arrested an alleged ringleader. The crew denies any connection, a

    zubiqo.com · 14d ago · September 30th, 2026

    The FBI is dropping threat videos aimed at ShinyHunters after Dutch police arrested an alleged ringleader. The crew denies any connection, a

    via Mastodon https://zubiqo.com/news/fbi-publicly-threatens-shinyhunters-hackers-after-disputed-dutch-arrest-e1dvkn

41. mentioned by www.npr.org

    FBI investigating massive data breach of the bureau's job portal https://www.npr.org/2026/09/30/nx-s1-5985084/fbi-investigating-massive-data

    www.npr.org · 13d ago · September 30th, 2026

42. update from securityweek.com

    ShinyHunters Defiant After FBI Calls on Members to Come Forward

    securityweek.com · 13d ago · September 30th, 2026

    The FBI on Tuesday called on ShinyHunters group members to come forward in the wake of the alleged leader’s arrest. The suspected leader, Pepijn van der Stap, of Amsterdam, was arrested on September 15 in the Netherlands while on probation after serving three of the four-year prison term he was sentenced to in 2023 over hacking and extortion activities. “After his arrest on September 15, a lot of information was found on his laptop, including about two murders that should be committed abroad. There are indications that the defendant has ordered this,” reads an automated translation of the Dutch police’s announcement . “They often target third-party vendors in cloud-based platforms, stealing sensitive data and extorting victims with threats to publish it,” said FBI Cyber Division Assistant Director Brett Leatherman. “To the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague

43. mentioned by www.nytimes.com

    employees and operators with similar personnel data exposure should immediately enroll in identity monitoring services and watch for targete

    www.nytimes.com · 13d ago · September 30th, 2026

44. mentioned by www.npr.org

    FBI hunting the hackers who stole its employees' sensitive data https://www.npr.org/2026/09/30/nx-s1-5985202/fbi-hack-shinyhunters # CyberSe

    www.npr.org · 13d ago · September 30th, 2026

45. mentioned by www.404media.co

    # FBI Hackers Say They Won’t Publish Massive Trove of FBI Employee Data https://www. 404media.co/fbi-hackers-say-th ey-wont-publish-massive-

    www.404media.co · 13d ago · September 30th, 2026

46. update from www.npr.org

    Reward: You've received the Tarnished Investigator's Badge — cosmetic only, offers no protection. https://www. npr.org/2026/09/30/nx-s1-5985

    www.npr.org · 11d ago · October 2nd, 2026

    Reward: You've received the Tarnished Investigator's Badge — cosmetic only, offers no protection.

47. update from www.npr.org

    https://www. npr.org/2026/09/30/nx-s1-59852 02/fbi-hack-shinyhunters # Cybersecurity # DataBreach # FBI # ShinyHunters # InfoSec # Achieveme

    www.npr.org · 10d ago · October 3rd, 2026

    npr.org/2026/09/30/nx-s1-59852 02/fbi-hack-shinyhunters # Cybersecurity # DataBreach # FBI # ShinyHunters # InfoSec # Achieveme

    via Mastodon https://www.npr.org/2026/09/30/nx-s1-5985202/fbi-hack-shinyhunters