# FBIJobs.gov breach: ShinyHunters stole FBI staff data, and DOJ employees are now likely affected too · pwn.watch > The ShinyHunters group breached FBIJobs.gov, the FBI's unclassified jobs and background-check portal, and in September 2026 claimed data on nearly all FBI employees. The FBI called it a major cyber incident and says Social Security numbers, birth dates, addresses, phone numbers and emergency contacts were taken; it is operating as if every employee's data was exposed. The bureau blamed a contractor who failed to install an issued security patch on the third-party-managed platform (Oracle PeopleSoft, run by Accenture, according to Reuters' sources). On Nov 3 2026 POLITICO reported a Justice Department memo warning that employees in U.S. attorney offices were likely affected as well. Page: https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026 · generated 2026-11-05T03:51:00.218Z ## Status - Severity: high · status: live · patch: partial - Product: FBIJobs.gov (FBI jobs and background-check portal) - Started: 2026-09-22 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026/feed.xml - JSON Feed: https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026.json - This file: https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026/llms.txt ## Updates (newest first) - 2026-11-03: POLITICO reports a Justice Department memo warning select employees in U.S. attorney offices that their personal data was likely stolen in the same FBIJobs.gov hack, widening the breach beyond FBI staff. DOJ is notifying people as the FBI verifies the data. (https://www.politico.com/news/2026/11/03/fbi-hack-department-justice-letter-01146667) - 2026-10-06: FBI cyber chief Brett Leatherman says the breach happened because a contractor failed to install a security patch explicitly issued for a third-party-managed platform, and that the contractor was removed. Reuters' sources name the platform as Oracle PeopleSoft and the contractor's employer as Accenture. (https://www.securityweek.com/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/) - 2026-09-25: The FBI notifies Congress that the FBIJobs.gov hack is a major incident; stolen data includes Social Security numbers, birth dates, phone numbers, addresses and emergency contacts used in background checks. (https://www.politico.com/news/2026/09/28/fbi-hack-major-incident-social-security-01096590) - 2026-09-22: The ShinyHunters extortion group announces it hacked FBI systems through the FBIJobs.gov jobs portal and claims data on nearly all FBI staff. The FBI determines the same day that the hack is a major cyber incident and sends its first agency-wide email about it. (https://www.politico.com/news/2026/09/28/fbi-hack-major-incident-social-security-01096590) ## Fix brief # Security brief: FBIJobs.gov breach: ShinyHunters stole FBI staff data, and DOJ employees are now likely affected too Source: https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026 · status: live · severity: high · updated Nov 5, 2026, 03:39 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is The ShinyHunters group breached FBIJobs.gov, the FBI's unclassified jobs and background-check portal, and in September 2026 claimed data on nearly all FBI employees. The FBI called it a major cyber incident and says Social Security numbers, birth dates, addresses, phone numbers and emergency contacts were taken; it is operating as if every employee's data was exposed. The bureau blamed a contractor who failed to install an issued security patch on the third-party-managed platform (Oracle PeopleSoft, run by Accenture, according to Reuters' sources). On Nov 3 2026 POLITICO reported a Justice Department memo warning that employees in U.S. attorney offices were likely affected as well. Severity detail: Sensitive PII (SSNs, home addresses, emergency contacts) of FBI personnel and likely DOJ staff, with physical-safety risk for agents and prosecutors; number of DOJ employees affected not disclosed - Product: FBIJobs.gov (FBI jobs and background-check portal) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes There is nothing for the public to patch. If you run Oracle PeopleSoft, make sure Oracle's June 2026 fix for CVE-2026-35273 is actually installed, not just covered by WAF rules. FBI and DOJ staff and applicants should expect targeted phishing and calls using their personal details. ## Latest updates - Nov 3, 2026: POLITICO reports a Justice Department memo warning select employees in U.S. attorney offices that their personal data was likely stolen in the same FBIJobs.gov hack, widening the breach beyond FBI staff. DOJ is notifying people as the FBI verifies the data. - Oct 6, 2026: FBI cyber chief Brett Leatherman says the breach happened because a contractor failed to install a security patch explicitly issued for a third-party-managed platform, and that the contractor was removed. Reuters' sources name the platform as Oracle PeopleSoft and the contractor's employer as Accenture. - Sep 25, 2026: The FBI notifies Congress that the FBIJobs.gov hack is a major incident; stolen data includes Social Security numbers, birth dates, phone numbers, addresses and emergency contacts used in background checks. - Sep 22, 2026: The ShinyHunters extortion group announces it hacked FBI systems through the FBIJobs.gov jobs portal and claims data on nearly all FBI staff. The FBI determines the same day that the hack is a major cyber incident and sends its first agency-wide email about it. ## Write-ups & news - [Social Security numbers, birth dates compromised in 'major' hack of FBI jobs portal](https://www.politico.com/news/2026/09/28/fbi-hack-major-incident-social-security-01096590) - [FBI says contractor failure led to hack of its jobs website](https://www.nbcnews.com/politics/justice-department/fbi-hack-jobs-website-contractor-failure-rcna601928) - [FBI Blames Contractor's Missed Patch for ShinyHunters Breach](https://www.securityweek.com/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/) - [DOJ warns FBI data breach likely extends to Justice Department employees](https://www.politico.com/news/2026/11/03/fbi-hack-department-justice-letter-01146667) ## Caveats The FBI has not publicly named the contractor, the platform or the exact vulnerability; the PeopleSoft and Accenture identifications come from Reuters' sources. Mandiant has separately tied ShinyHunters to mass exploitation of Oracle PeopleSoft CVE-2026-35273, but the FBI has not linked its breach to that CVE. The FBI says multiple ShinyHunters suspects have been arrested. --- Machine-readable: https://pwn.watch/i/fbijobs-gov-shinyhunters-breach-fbi-doj-employees-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.