FBI Hit by Massive Cyberattack: PeopleSoft Flaw Exposes Tens of Thousands of Employees’ Personal Data
A major cyberattack on the FBI has potentially exposed the home addresses, Social Security numbers, family details, and sensitive intelligence assignments of tens of thousands of current and former employees. According to two people familiar with the matter, the stolen data is believed to include personal information on hundreds of FBI intelligence analysts and other personnel involved in clandestine intelligence-gathering and surveillance. The breach raises fears that the stolen information could put agents and their families at risk. The attackers exploited a critical vulnerability in PeopleSoft, a widely used enterprise software tool employed by the FBI and major clients across IT services, corporations, government, and academia. How the attackers entered the FBI system remains under investigation, but Google last week reported that the hacking group ShinyHunters had renewed “mass exploitation” of the PeopleSoft flaw, identified as CVE-2026-35273, across multiple industries. The group is known for targeting major companies in tech, finance, and retail, often stealing millions of customer records at once.
Under federal law, alerting Congress is required when an intrusion meets the bar of a “major incident” — such as if a data breach involves the theft of personally identifiable information that is “likely to result in demonstrable harm” to U.S. persons. A White House spokesperson deferred comment to the FBI when asked if the bureau had declared a major incident. Meanwhile, the FBI’s job site, which has been the primary way to apply for a job with the bureau since 2017, remains down at the time of publication, according to ABC News. The outage underscores the severity of the breach and its impact on the bureau’s operations.
The incident highlights the growing threat posed by sophisticated hacking groups exploiting known vulnerabilities in widely used software. As the investigation continues, the FBI faces mounting pressure to secure its systems and protect the sensitive data of its employees. The potential exposure of clandestine intelligence assignments is particularly alarming, as it could compromise ongoing operations and endanger personnel. This breach serves as a stark reminder of the critical need for robust cybersecurity measures across all government agencies and private sectors alike.
Shimanta Das 
