The cybercrime group ShinyHunters breached FBI networks and stole as much as 3 TB of sensitive data on nearly all bureau agents and job applicants. Stolen records include psychiatric evaluations, medical diagnoses, and prescriptions from the Medlink system, along with phone numbers, physical addresses, and names of agents' spouses. The intrusion also exposed members of the Bureau's Remote Operations Unit, a secretive team that develops exploit tools, and included personnel involved in counterintelligence and cyber investigations against Russia and China.

The group used an unpatched Oracle PeopleSoft zero-day vulnerability with a CVSS score of 9.8 to temporarily deface the FBI's recruitment website and access the records. ShinyHunters demanded the FBI remove a 2026 Q2 FLASH report containing "false allegations" about the group's operations within one week, stating the hack was retaliation for the report. The FBI is investigating the unauthorized activity on its jobs website but has not confirmed the full extent of the data theft.