Threat hunters and researchers are alarmed by what they’ve seen in data ShinyHunters claims it stole from the FBI. Limited samples of the stolen data contain FBI agents’ personal contact information, details on family members, office and duty assignments and, in some cases, information on agency personnel specialties, multiple sources said.
“I am gravely concerned about the implications it opens up,” a researcher who has viewed and studied a sample of the data told CyberScoop.
“It’s a roadmap for every s—y country, and drug cartel, and insane person to locate exactly who in the FBI they have a grievance with, and show up at their home or attack a person close to them,” the researcher who requested and was granted anonymity to share sensitive information added.
In a lengthy post on its data-leak site, the group claimed it stole data on almost every FBI agent and people who applied for an agency job. The FBI jobs site, which was temporarily defaced by ShinyHunters, remains offline as of Monday.
The FBI hasn’t confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly. The agency said it is “actively and aggressively investigating” the incident, the root cause and its alleged impact to FBI employees’ personally identifiable data in a statement Wednesday.
Stolen data puts FBI agents at serious risk
While the full scope of the attack remains under investigation, cybercrime experts are startled by the potential counterintelligence exposure and safety risks lurking in data ShinyHunters has shared with journalists in a bid to bolster its claims and mount public pressure on the FBI. CyberScoop has not viewed the stolen data.
“The counterintelligence concern is that assignment information could help hostile actors identify people working on issues relevant to them. That creates risk for personnel and could put sources or investigations connected to their work at risk,” said Jon DiMaggio, principal researcher at Arkem Cyber.
“I know firsthand what it is like to have the people you are investigating know who you are. It adds a different dimension to the stress and mental weight of the job,” he added. “If the information is accurate, agents may have to consider the possibility of being targeted directly. It is a whole different ball game when you do not know the identity of the person you are investigating, but they know exactly who you are.”
Cynthia Kaiser, a former FBI official, noted that some of the data ShinyHunters stole from the FBI has already been distributed widely beyond control. The sample data ShinyHunters shared with journalists was available on its internal forum, granting anyone with access the ability to pass the information on to others, she wrote in a LinkedIn post.
“The link no longer works, but the damage is done. Screenshots, downloads, emails — once data is disseminated, you can’t pull it back and delete all copies,” wrote Kaiser, now a senior vice president at Halcyon’s ransomware research center.
“Even technically, once threat actors send victims a sample of what they stole, they have probably made five-plus copies of the stolen data,” she added. “There is no way to verify all data was deleted, and the FBI has said that whenever it gets onto ransomware group infrastructure, it finds data that the group promised would be deleted.”
Experts dumbfounded by ShinyHunters’ claimed objective
ShinyHunters said it targeted the FBI and stole sensitive data to refute details the agency shared in a public service announcement it issued in May about the group’s operations, affiliations and tactics.
The cybercrime group disputes multiple FBI assertions and specifically insists it is not affiliated with The Com, has never conducted swatting attacks or claimed it had sensitive or compromising information, including embarrassing photos or videos, to extort victims.
ShinyHunters said it wants the FBI to remove or amend the public service announcement, and set a Monday deadline for the agency to take action.
Researchers are dumbfounded by ShinyHunters’ coercive action. “This is retaliation, which is crazy because they have just put a massive target on themselves. But clearly they are not concerned about the FBI and do not believe the bureau has the capacity to find and arrest them,” DiMaggio said.
“The thing they are trying to extort is truly insane. They want to censor an FBI report because their feelings are hurt,” the anonymous researcher told CyberScoop.
“Their best course of action would be to walk away from the entire situation,” the researcher added. “They need to walk away from the issue and leave this data alone.”
‘This one’s personal’
ShinyHunters typically engages in cybercrime for financial extortion. The threat group previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Some of the group’s most high-profile victims this year include Instructure, Salesforce, Snowflake and McKesson.
Various cybercriminals have been tied to activity attributed to the ShinyHunters name. “My assessment is that it operates as a criminal brand used by a fluid network, with a core group and a wider circle of associates who may support access, data handling, infrastructure or distribution,” DiMaggio said.
“The people and roles can change, and the name alone does not identify who was behind this intrusion,” he added.
The anonymous researcher concurred with that analysis, adding that multiple people are likely involved with some potential internal conflicts and disagreement over the attack on the FBI.
Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia.
Yet, “this one’s personal, and that’s the difference,” DiMaggio said.
“It’s not just an agency getting hacked. It’s agents’ identities, their work, and possibly their families being exposed,” he added. “These guys don’t just attack organizations for money. Often it’s for clout and bragging rights or a personal vendetta, which I believe is the case here.”
ShinyHunters’ public attempt to extort the FBI marks a major point of escalation riding on a rare motive.
“The tactics and methods behind the attack are the same as any data theft compromise. The difference is the damage it can cause to the organization and the people who are supposed to prevent and prosecute criminals like ShinyHunters,” DiMaggio said.
“This was a bold, personal move against law enforcement and has less to do with money,” he added. “There is a financial component, but the publicity and bravado likely mean more to the criminals than the money.”