FBI Hit by Massive Cyberattack: Personal Data of Tens of Thousands of Employees at Risk
A major cyberattack on the FBI may have exposed the home addresses, Social Security numbers, family details, and sensitive intelligence assignments of potentially tens of thousands of current and former employees. According to two people familiar with the matter, the stolen data is believed to include personal information on hundreds of FBI intelligence analysts and other personnel involved in clandestine intelligence-gathering and surveillance. The breach has raised fears that the stolen information could put agents and their families at risk, as it may allow malicious actors to target individuals based on their classified roles.
The attackers are suspected to have exploited a critical vulnerability in Oracle’s PeopleSoft software, identified as CVE-2026-35273. Google recently warned that the hacking group ShinyHunters had renewed “mass exploitation” of this flaw across multiple industries. How exactly the attackers entered the FBI system remains under investigation. The FBI’s job site, which has been the primary way to apply for a job with the bureau since 2017, remains down at the time of publication, according to ABC News.
Under federal law, alerting Congress is required when an intrusion meets the bar of a “major incident” — such as if a data breach involves the theft of personally identifiable information that is “likely to result in demonstrable harm” to U.S. interests. A White House spokesperson deferred comment to the FBI when asked if the bureau had declared a major incident. The FBI has not yet publicly confirmed whether it has made such a declaration.
The breach underscores the growing threat posed by ransomware and hacking groups targeting government agencies and critical infrastructure. The involvement of ShinyHunters, known for high-profile attacks, highlights the need for robust cybersecurity measures. As the investigation continues, the FBI faces the challenge of securing its systems and protecting its employees from potential harm. The incident also serves as a reminder of the importance of timely patching and vulnerability management, especially for widely used enterprise software like PeopleSoft.
Shimanta Das 
