FBIJobs.gov Breach: New Jordan Detention As ShinyHunters Probe Widens
Jordanian authorities detained a suspected ShinyHunters member, Saif al-Din Khader, during the week ending Sunday, October 4, 2026, and U.S. officials say he is cooperating with investigators.[1] The arrest is a fresh lead in the FBI probe of claims that the bureau's hiring portal was breached and that sensitive personnel records were stolen.[1]
Dutch authorities previously arrested an Amsterdam resident identified by U.S. sources as 24-year-old Pepijn van der Stap as part of the investigation.[2] The FBI says it is working around the clock, has issued multiple bureau-wide communications to potentially impacted personnel, and will "spare no resource" in the probe.[1]
On Tuesday, September 22, 2026, ShinyHunters publicly claimed it stole sensitive personnel records and briefly defaced the FBIJobs.gov homepage before the portal went offline.[3] The group said the files included names, home addresses, phone numbers, spouses' names and some medical information and described the scope as affecting "almost ALL" current and former agents and applicants.[3] ShinyHunters also said it exfiltrated roughly 2-3 terabytes and exploited a newly disclosed Oracle PeopleSoft vulnerability tied to the FBI recruiting system.[4]
The FBI has confirmed it is "actively and aggressively investigating" the claimed compromise but says the point of breach remains undetermined and may involve third-party vendors.[5] Early reports emphasized that uncertainty, but later coverage and interviews with current and former employees indicate portions of the material correspond to real personnel records and that some staff first learned of the incident from media accounts.[6] FBI Cyber Division assistant director Brett Leatherman has publicly vowed to find those responsible as investigators pursue leads across multiple countries.[6]
Show source details & analysis (10 sources)
📌 Key Facts
- The bureau’s hiring portal, FBIjobs.gov, was taken down entirely on Tuesday, September 22, 2026, and remained inaccessible into the morning of Wednesday, September 23, 2026; the homepage briefly displayed a defacement banner before the site went offline (FBIjobs.gov).
- The hacking group ShinyHunters publicly claimed on September 22, 2026 that it stole sensitive personnel records for thousands—describing the scope as affecting “almost ALL” current and former agents and applicants and saying the records include names, home addresses, phone numbers, spouses’ names and some medical information—while posting an extortion-style demand tied to an FBI May 2026 advisory (ShinyHunters).
- ShinyHunters and reporting by outlets say the group claims to have exfiltrated roughly 2–3 terabytes of data and exploited a newly disclosed vulnerability in Oracle PeopleSoft — the HR platform used by FBI recruiting — listing criminal justice, HR and Medlink systems as affected (Oracle PeopleSoft).
- The FBI has publicly confirmed it is “actively and aggressively investigating” the claimed compromise, saying the "point of breach" remains undetermined, that the incident may involve third‑party providers, and that the bureau is working with those vendors to mitigate risk (point of breach).
- Reporting indicates that portions of data provided by ShinyHunters correspond to real FBI or Justice Department personnel records, though outlets and the FBI have not yet independently verified that the files originated from FBI systems (portions of data).
- Law-enforcement actions linked to the probe include a Dutch arrest of an Amsterdam resident identified by sources as Pepijn van der Stap and, during the week ending Sunday, October 4, 2026, Jordanian authorities detained a suspected ShinyHunters member, Saif al‑Din Khader, whom U.S. officials say is cooperating with investigators; the FBI says it has used those leads and will “spare no resource” in the probe (Saif al-Din Khader).
- Current and former FBI employees told reporters many first learned of the breach from media accounts and estimated the stolen material could total “several terabytes” of text files—job applications, promotion records, sensitive job postings, family details and medical data—that could require protections such as relocation or identity changes for some former undercover personnel (current and former FBI employees).
- FBI Cyber Division leadership has publicly vowed to pursue those responsible: Assistant Director Brett Leatherman posted a video warning ShinyHunters members that the bureau knows how to find them as the agency continues an around‑the‑clock investigation and sends communications to potentially impacted personnel (Brett Leatherman).
📰 Source Timeline (10)
Follow how coverage of this story developed over time
October 04, 2026
8:36 PM
ShinyHunters hacker detained in Jordan, cooperating with FBI, sources say
New information:
- Jordanian authorities detained suspected ShinyHunters member Saif al-Din Khader during the week ending Sunday, October 4, 2026, and U.S. officials say he is cooperating with investigators.
- U.S. officials told CBS News it remains unclear how many additional alleged ShinyHunters hackers may be involved beyond those already detained.
- The FBI issued a new statement saying it has already worked with partners to arrest multiple subjects in the ShinyHunters probe and will 'spare no resource' in bringing responsible individuals to justice.
- CBS confirmed via sources that the Dutch suspect arrested on September 15, 2026, is 24-year-old Amsterdam resident Pepijn van der Stap.
- ShinyHunters told Reuters that van der Stap had 'no association' with the group and accused Dutch police of incompetence.
September 30, 2026
12:29 PM
FBI hunting the hackers who stole its employees' sensitive data
New information:
- On Tuesday, September 29, 2026, FBI Cyber Division Assistant Director Brett Leatherman posted a video vowing to hunt down ShinyHunters members and urging them to come forward, saying, "You know how to find us, and we know how to find you."
- The FBI told NPR it is "aggressively" investigating how hackers obtained sensitive FBI employment information, including whether they compromised third-party software or internal FBI systems tied to FBIJobs.gov.
- An FBI spokesperson said the bureau is working "around the clock" on the FBIJobs.gov incident and has issued multiple bureau-wide communications within 24 hours of public reporting to those who may be impacted.
- Current and former FBI employees interviewed anonymously by NPR say many first learned of the breach from media reports and estimate the stolen data may amount to "several terabytes" of text files including job applications, promotion details, sensitive job postings, family details and medical data.
- Some retired FBI employees who previously worked undercover told NPR they may need protection measures such as relocation assistance or even legal name changes if their data is exposed.
- A former senior FBI official told NPR the breach could be on par with the 2015 Office of Personnel Management hack of tens of millions of federal records but raises greater concern that materials could be weaponized or resold by ShinyHunters or hostile actors.
September 29, 2026
5:24 PM
Dutch police arrest alleged cybercriminal who bragged about hacking FBI
New information:
- On Tuesday, September 29, 2026, Dutch national police announced they arrested an alleged member of a cybercriminal organization who they say bragged about hacking the FBI.
- CBS identified the suspect only as an alleged member of the group and emphasized that Dutch police linked the arrest to boasts about breaching FBI systems.
- The CBS video segment frames the arrest as part of the investigation into the claimed FBI hack but does not provide additional technical or attribution details beyond prior written coverage.
1:43 PM
Dutch National Police arrest member of group that claimed to have hacked FBI
New information:
- On Tuesday, September 29, 2026, the FBI and Dutch National Police jointly arrested a suspected member of ShinyHunters, described by FBI Director Kash Patel as 'one of the alleged leaders' of the group.
- The arrest came about a week after ShinyHunters claimed responsibility for defacing the FBIJobs.gov website and for stealing 2–3 terabytes of data about FBI personnel and job applicants.
- In a new public statement, the FBI said it is 'working around the clock' to investigate the FBIJobs.gov cyber incident and is in regular communication with potentially impacted individuals, with multiple bureau-wide communications sent within 24 hours of public reporting.
- The FBI reiterated that the investigation remains ongoing and that teams are using leads from the arrest to pursue additional actions.
- The article notes a New York Times report that an internal FBI email acknowledged personal information of some employees had been stolen in what the bureau labeled a cybersecurity incident, though CBS News has not independently verified that memo.
September 23, 2026
9:37 PM
FBI investigates hackers' claim to have stolen employee data, compromised jobs website
New information:
- On Wednesday, September 23, 2026, the FBI issued a public statement saying it is 'actively and aggressively investigating' a claimed compromise of the FBIJobs.gov portal and 'alleged impact' to FBI employee personally identifiable information.
- The FBI said the 'point of breach' remains undetermined and that it is working closely with the third-party providers that support FBIJobs.gov to mitigate any and all risk.
- As of Wednesday afternoon, September 23, 2026, FBIJobs.gov, the bureau's main hiring portal, remained offline following the claimed breach.
- A message circulated online from the ShinyHunters hacking group claimed, 'We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,' and asserted it had compromised the jobs website.
- ShinyHunters demanded that the FBI within one week correct or remove a May FBI public service advisory describing the group as a 'cyber criminal group specializing in large-scale data breaches and extortion,' saying it was 'offended' by those characterizations.
- In its message, ShinyHunters said, 'This is not a ransom, coercion, or extortion... This PSA is NOT financially motivated,' and did not specify what it would do if the FBI failed to change the advisory.
- The article reiterates that earlier in March 2026 the FBI disclosed it was investigating 'suspicious activities' on an internal system related to surveillance operations, and that a pro-Iranian hacking group separately claimed to have posted historical personal information about Director Kash Patel.
8:59 PM
Cybercriminal group claims it stole FBI personnel and applicant data
New information:
- Article reports ShinyHunters claim to have stolen 2-3 terabytes of data about FBI and Justice Department personnel and applicants in a breach they say occurred Monday, September 21, 2026.
- Hackers specifically claim they exploited a new vulnerability in Oracle PeopleSoft, the human resources platform used by the FBI's recruiting arm, and list criminal justice, human resources and Medlink systems as affected services.
- On Tuesday, September 22, 2026, the FBI careers homepage displayed a "System Unavailable" notice stating apply.fbijobs.gov and the Special Agent Applicant Portal were unavailable.
- On Wednesday, September 23, 2026, the FBI issued a more detailed statement confirming an investigation into a claimed compromise of FBIJobs.gov, saying the breach point is undetermined and may involve third-party providers, and that the bureau is working with those providers to mitigate risk.
- Reuters and 404 Media reported that portions of data provided by ShinyHunters correspond to real FBI or Justice Department personnel records, although they have not confirmed the data came from FBI systems; CBS notes it has not independently verified the data.
- The story confirms via FBI documents that FBI recruiting uses PeopleSoft and AWS GovCloud, and states that while the claimed vulnerability and large-scale theft are plausible, ShinyHunters' assertions remain unverified by CBS.
- The article details ShinyHunters' dark-web post addressed to FBI Director Kash Patel and cyber official Brett Leatherman, in which the group disputes the FBI's May 2026 FLASH bulletin characterization and sets a one-week deadline to "correct or remove" parts of that advisory.
6:59 PM
FBI probes jobs portal breach amid claims employee data was compromised
New information:
- On Wednesday, September 23, 2026, the FBI publicly confirmed it is investigating a breach of its jobs portal after a cybercriminal group claimed to have obtained sensitive personal information belonging to bureau employees.
- In its statement, the FBI said it has not yet determined whether the breach originated within FBI systems or through a third-party provider that supports the primary recruitment website, FBIjobs.gov.
- The FBI said it is 'actively and aggressively investigating' the incident and working with third-party providers to mitigate potential risks.
- As of Wednesday afternoon, September 23, 2026, the FBIjobs.gov website was inaccessible.
- The article reiterates that ShinyHunters has claimed responsibility and alleged it obtained sensitive information about FBI personnel and job applicants, while noting that the scope of the breach and the group’s claims have not been independently verified.
4:38 PM
Hackers Say They Stole Thousands of Sensitive F.B.I. Personnel Records
New information:
- On Tuesday, September 22, 2026, ShinyHunters publicly claimed to have stolen sensitive personnel data for thousands of FBI officials and applicants from the bureau’s online jobs portal.
- The group says the records include names, home addresses, phone numbers, spouses’ names, some medical information and other personal data for current and former agents and job applicants, and described the scope as affecting "almost ALL" FBI agents and applicants.
- ShinyHunters posted an extortion-style message addressed to FBI Director Kash Patel and cyber official Brett Leatherman demanding that the FBI "correct or simply REMOVE" its spring advisory about the group within a week or face unspecified consequences.
- The FBI jobs site was taken offline, and its homepage on Tuesday carried a defacement banner reading "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS" before the portal became inaccessible; it remained offline on the morning of Wednesday, September 23, 2026.
- An FBI spokeswoman formally acknowledged the incident, saying the bureau is aware of the claims and is investigating, but declined to provide further details.
- In messages to The New York Times, ShinyHunters indicated the stolen dataset covers tens of thousands of individuals, though the group has not yet leaked samples publicly.
3:05 PM
FBI investigates after ShinyHunters hackers claim theft of agents' personal data
New information:
- The Fox article confirms that the FBI jobs portal, FBIjobs.gov, was taken down entirely on Tuesday, September 22, 2026, and remained offline as of Wednesday morning, September 23, 2026.
- Fox quotes a fresh FBI statement reiterating that the bureau is aware of claims of unauthorized activity affecting FBIjobs.gov and is investigating, matching but independently confirming earlier Axios-based reporting.
- Fox adds that ShinyHunters told Reuters it stole information on "almost all" FBI agents and job applicants, underscoring the claimed scale of the breach.
- The article explicitly links the attack to the FBI's May 2026 public service announcement that warned organizations about ShinyHunters' tactics and urged victims not to pay ransom or extortion demands, and says ShinyHunters portrayed the hack as retaliation for that PSA.
- Fox recaps additional ShinyHunters-linked incidents, including a May breach of the Canvas learning platform that disrupted U.S. schools and past claims of targeting Rockstar Games, AT&T, Ticketmaster, Microsoft and multiple universities, plus Anthropic's recent report of attempted misuse of its AI tools by hackers tied to the group.
September 22, 2026