ShinyHunters, a prolific data extortion group, claims it breached the FBI’s jobs platform (FBIJobs[.]gov) and related systems, defaced the site with its Umbreon Pokémon mascot, and stole 2-3 TB of sensitive data on current and former employees and job applicants. The group says it exploited a new Oracle PeopleSoft zero‑day vulnerability for remote code execution (RCE), then moved laterally into FBI-managed AWS GovCloud and internal services including HR, Criminal Justice, Medlink, PEGA, PHIRE, and more. Samples of roughly 5,000 purported FBI employee records shared with media outlets have been partially verified, though the alleged zero‑day and full data volume remain unconfirmed. ShinyHunters frames the attack as retaliation for a May 2026 FBI FLASH report and PSA that, in the extortion group’s view, falsely portrayed the group as exaggerating access, conducting swatting, and engaging in sextortion. The group denies those behaviors, rejects being part of “The Com” cybercrime ecosystem and says this action against the FBI is not financially motivated, demanding instead that the FBI correct or remove the report. The FBI has acknowledged “unauthorized activity affecting FBIJobs[.]gov” and is investigating, while experts foresee and warn that detailed personnel data on law-enforcement staff could be abused for targeted fraud, intimidation, or follow‑on cyber and physical attacks. CTIX Analysts will continue to provide up-to-date reporting on this incident.