The FBI has declared an official cyber security incident over the breach of its job application portal, and the stolen data reportedly includes medical and psychiatric records of agents, TechCrunch reported Monday. The hacking group ShinyHunters got in through a vulnerability in an Oracle PeopleSoft server that held human resources data on agents and applicants.

What Happened

MS Now reporter Ken Dilanian first reported over the weekend that the FBI had notified employees internally of the incident declaration. The bureau had earlier said the extent of any data theft was still undetermined. BBC News and Reuters later reported additional details of what was taken, and TechCrunch said it received statements directly from the group.

According to those reports, the stolen information includes names, home addresses, job titles, Social Security numbers, results of blood and urine tests, and psychiatric reports. The people affected include FBI agents, support staff and applicants who applied through FBIJobs.gov, which has been the bureau's main hiring channel since 2017. The portal remained offline at the time of TechCrunch's report.

RelatedFrance Widens Fridge-Hack Alert to More Controllers as Store Count Passes 350

ShinyHunters has not asked for money. Instead it wants the FBI to correct an earlier public report that the group says misrepresents it. CyberScoop reported that the group is referring to a May 2026 public service announcement and had set a Monday deadline. The FBI has said little beyond confirming that it is investigating the incident, its root cause and the alleged impact on employees' personal information.

Why It Matters

The confirmation moves the breach from a criminal group's claim, first made on Sept. 22, to an acknowledged incident, and the reported data types are more sensitive than the personnel details initially described. Medical and psychiatric records are among the most sensitive categories of personnel data, and for people in law enforcement and intelligence roles their exposure carries risks of coercion and embarrassment that a leaked address does not.

Researchers have warned about the counterintelligence angle. Jon DiMaggio of Arkem Cyber told CyberScoop that assignment details could help hostile actors identify who works on issues relevant to them, and Cynthia Kaiser, a former FBI official now at Halcyon, noted that once data spreads, copies cannot be recalled.

The PeopleSoft Link

Help Net Security reported that the group claims it used a PeopleSoft zero-day, now tracked as CVE-2026-35273, and that the initial compromise dates to May or June. Analysts at Google Cloud's Mandiant have documented ShinyHunters evading web application firewall rules by URL-encoding a single character in the request path, meaning organizations that relied on WAF rules without patching remained exposed. In the intrusions Mandiant examined, the attackers then deployed web shells and the MeshAgent remote-management tool. PeopleSoft is widely used for HR and payroll across government and large enterprises, so the same flaw puts many other organizations' employee records at risk.

What to Watch

Federal law requires agencies to notify Congress of a "major incident" involving personal information likely to cause demonstrable harm to national security. It is not yet clear whether the FBI has done so; if it has, it would be the bureau's second such notification in 2026, after an April breach of a surveillance system. Other open questions are when the jobs portal returns, whether affected people are formally notified, and whether ShinyHunters publishes the data if its Monday deadline for a correction passes unmet.