# ShinyHunters **A financially motivated cybercrime and data-extortion group** that in September 2026 breached the [[FBI]]'s public-facing jobs portal (FBIJobs.gov) and took personnel data on bureau employees and applicants. The breach matters to this KB less as a cybercrime story than as a **state-capacity story**: it is the clearest single measure of how far the bureau's internal competence degraded under [[Kash Patel]]. ## The FBI jobs-portal breach (September 2026) - The group claimed the breach publicly in **September 2026**; the FBI confirmed it was investigating on **September 22, 2026**. - The compromised system was the bureau's **public job-application portal**, which held personal data on employees and applicants. - Reported exposed data categories include **names, home addresses, cell phone numbers, FBI email addresses, employee ID numbers**, and **personal identifying information for emergency contacts**, including Social Security numbers and personal email addresses. - The group told reporters it had hacked the FBI to "protect our business" — a response to law-enforcement pressure rather than an espionage motive — and later said it would not leak the most sensitive material. - By **October 5, 2026** the FBI had confirmed **multiple arrests** connected to the group. - **Scale:** reporting puts the total at roughly **38,000 individuals** — current and former staff plus everyone who had applied to the bureau for a job. ShinyHunters' own claim was that it held data on "almost ALL FBI Agents and individuals who filed an application with the FBI for a job," and MS NOW reported the hack "hit most employees." - **Most damaging category:** the data reportedly included **job assignments**, among them sensitive operations against Chinese and Russian intelligence and drug cartels — which is why officials called it a counterintelligence problem rather than a privacy one. > [!warning] Sourcing — the state-and-local figure > That the breach also reached **more than 8,000 state and local law enforcement officers > who had worked with FBI agents** comes from MS NOW reporting by Ken Dilanian and Carol > Leonnig (October 3, 2026), relayed in [[Heather Cox Richardson]]'s letter of > October 4, 2026. The *direction* is corroborated — MS NOW's own headline says the breach > "extends to local officials" — but the **number itself remains single-sourced** as of > 2026-10-05 and is recorded as attributed reporting. Re-searched 2026-10-05; the 38,000 > total above does not break out a state-and-local component. ## Why it matters FBI officials and outside experts quoted by MS NOW characterized the breach as a **counterintelligence disaster** — one of the worst in U.S. history. The exposure is not only of individuals but of the bureau's priorities and staffing, because knowing who works on what is itself intelligence, and the stolen records reportedly named active counterintelligence and cartel assignments. A bureau cybersecurity expert attributed the cause to internal error rather than attacker sophistication, saying the data belonged on the internal system and should never have been connected to the internet. That is the throughline worth tracking: the attack did not require a sophisticated adversary, and the people who ran it reportedly could not believe how easy it was. The breach belongs in the same column as other 2026 administrative-capacity failures rather than in a column about adversary capability. ## See Also - [[FBI]] — the breached agency - [[Kash Patel]] — FBI director at the time of the breach - [[Intelligence Community Hub]] — the wider community the bureau sits in