Threat Intel
FBIjobs.gov Defaced by ShinyHunters; 5,000 Agent Records Leaked
The FBI’s job application portal was defaced by the ShinyHunters group, who replaced agency images with a Pokémon mascot and claimed to have stolen records of FBI agents and applicants. The group released 5,000 agent records to the public and threatened further leaks if their demands were not met. Defenders should verify the integrity of public‑facing sites, monitor for data exfiltration, and review access controls.
The FBI’s job application platform, FBIjobs.gov, was defaced on Tuesday by the ShinyHunters cybercriminal organization. The attackers replaced official agency images with a Pokémon photo, posted a statement on their leak site, and claimed to have stolen data on current and former FBI employees and applicants.
Impact
ShinyHunters supplied 5,000 FBI agent records to the media, confirming the breach. The FBI jobs site remains unavailable, and the group threatened to leak additional personal data if their demands were not met.
What to Do
- Validate the integrity of all public‑facing web assets; check for unauthorized image or content changes.
- Audit access logs for the FBIjobs.gov application to detect anomalous activity.
- Review and harden authentication and authorization controls for the portal.
- Monitor the dark web and leak sites for additional data releases related to your organization.
- Notify affected parties promptly and coordinate with law enforcement if personal data has been exposed.
Defenders should treat this incident as a reminder that even high‑profile government sites are not immune to web defacement and data exfiltration attacks.
Related articles
CenterPoint Energy Breach: 7.5 Million Customer Records Exposed via Unsecured Public API
Houston‑based utility CenterPoint Energy confirmed that an attacker stole and leaked 7.49 million customer records, including names, phone numbers, addresses, account numbers, billing amounts and partial SSNs. The intruder accessed the data by repeatedly querying a public API that lacked rate limiting, a web application firewall and other safeguards. CenterPoint has filed with the SEC, is working with third‑party experts, and has already faced class‑action lawsuits. The company reports that electric and gas services remain unaffected and believes the breach will not materially impact its finan
Read briefing
FBI Arrests ShinyHunters Operatives Following FBIjobs.gov Breach
The FBI detained three individuals linked to the ShinyHunters group after a breach of the FBIjobs.gov domain exposed sensitive employee data. The attack leveraged a known Oracle vulnerability and was traced to an unpatched Accenture contractor. Defenders should verify Oracle patch status, review access controls on recruitment portals, and monitor for similar data exfiltration patterns.
Read briefing
FBI Arrests Suspect in ShinyHunters Data Breach of Internal Agent Records
In September, the ShinyHunters hacking group publicly claimed to have exfiltrated a large set of FBI agent data. The FBI has arrested an associate of the group, marking a significant internal security breach. Defenders should review internal data access controls and monitor for similar exfiltration attempts.
Read briefing
Florida DMV Driver Database Breach: Stolen Police Credentials Reveal Over 200k Records
The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after the ShinyHunters extortion gang claimed to have accessed the system using stolen police credentials. The attackers exploited a compromised account belonging to a Plant City Police Department employee, who stored the login on a personal device. While ShinyHunters alleged a password‑reset flaw and claimed more than 200,000 records were exfiltrated, FLHSMV has not confirmed the exact number of records accessed. The agency has notified state authorities, halted further intrusion, and i
Read briefing