FBI agent homes, job titles in data hackers claim to have stolen

WASHINGTON — A trove of data that hackers say they stole from the Federal Bureau of Investigation includes records revealing the home addresses of employees involved in investigating foreign spies, drug cartels and running covert surveillance operations.

While the FBI hasn’t explicitly confirmed a hack, the bureau said in a statement Wednesday that it’s “actively and aggressively” investigating what it described as “the point of breach” and whether it involved a third party or the FBI’s enterprise system itself. A cybercrime gang has claimed responsibility for the incident and provided journalists with what they say is a sample of the stolen material.

That data, reviewed by Bloomberg News, contained information about at least 3,800 current or former FBI employees, including home addresses, phone numbers, email addresses, Social Security numbers, job titles, assigned field office and details about their emergency contacts, often a spouse or family member.

As of Thursday, some FBI employees whose personal information appears in allegedly hacked material hadn’t been notified of that by bureau security, according to a U.S. official familiar with the matter who spoke on condition that they not be identified because they weren’t authorized to discuss it. The authenticity of the full material could not be determined, but Bloomberg News cross-referenced names and addresses of several FBI employees contained in the hacked files and matched them with publicly available records.

FBI representatives declined to answer questions about the material on Thursday. The bureau previously said in a statement that it “is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal” and is “aggressively investigating this matter.”

Among the most sensitive information in the file reviewed by Bloomberg are details about the specific unit to which a particular employee is assigned.

In some cases, identifiable individuals appeared to be engaged in counter-intelligence work related to the Chinese and Russian governments. Other personnel were shown to be working for secretive units focused on conducting covert surveillance, tracking drug cartels, domestic counter-terrorism operations and cyber activities connected to the Middle East and Africa. The sample data contained entries that were dated as recently as April 2026.

“Anybody at the FBI would be very worried, especially the folks who didn’t choose to be public, rank and file employees,” said Cynthia Kaiser, former deputy assistant director of FBI’s cyber division and current senior vice president of cybersecurity firm Halcyon’s Ransomware Research Center. “Being able to conduct their jobs free of harassment is incredibly important. And I think if I was there today there would be a lot of nervousness and fear about what information might be going out.”

The FBI, along with many other U.S. government agencies, has been hacked in recent years. This spring, the FBI concluded that a breach of the networks it uses to manage wiretaps and other surveillance work qualified as a “major incident.” After hackers broke into AT&T Inc.’s systems in 2024, FBI leaders warned staff that they believed hackers stole months of their agents’ call and text logs, Bloomberg reported in 2025.

Darren Mott, a former FBI agent, said the greatest risk comes from the hackers sharing the latest material with foreign spies, or it otherwise making its way into the hands of a hostile foreign power.

“Knowing who works where puts a target on them for potential exploitation,” said Mott, who oversaw counterintelligence investigations in the FBI’s Huntsville, Alabama, office. “This makes international travel now problematic for” those FBI employees.

There also appears to be a record on State Department letterhead of FBI agents who have been deployed overseas. Justice Department psychological health evaluation forms, which summarize prior mental health problems that FBI employees have experienced, and medical examination reviews, including details about surgeries, were also accessible in the data trove. Those files were all dated between 2009 and 2012, raising the possibility that they may have been taken from an older archive.

Neither the State nor the Justice departments immediately responded to requests for comment.

The hacking group that most recently claimed to have breached the bureau is known as ShinyHunters. An apparent member of group, who did not provide their name, told Bloomberg they were giving the FBI a week to retract certain statements it had made about the gang. The hacker did not specify what would happen if the FBI refused to comply.

The person claimed that they had obtained access to several FBI servers after exploiting a software vulnerability in the website FBIjobs.gov. That website was returning an error message on Thursday and is not currently accessible.

ShinyHunters has previously been linked to a number of high-profile breaches, including attacks that targeted Salesforce, Jaguar Land Rover and AT&T. According to the cybersecurity firm Huntress, the group has been active since 2019 and is one of the most prolific data theft and extortion gangs in the world.

____

(With assistance from Patrick Howell O'Neill.)