The Federal Bureau of Investigation is promising an aggressive manhunt for the cybercriminal crew it believes stole sensitive personal information from the bureau's own hiring systems, escalating a confrontation with one of the most prolific data-extortion operations currently active.
Brett Leatherman, who serves as assistant director of the FBI's cyber division, delivered the warning in a video circulated on social media. Addressing the group known as ShinyHunters, which claimed responsibility last week for pulling reams of confidential material from the bureau, Leatherman made clear that federal investigators intend to identify and pursue those involved.
"You know how to find us, and we know how to find you," Leatherman said, according to the source account. He urged members of the loosely organized collective to step forward voluntarily and cooperate, suggesting they contact authorities before the situation worsens for them, and warning that the window for choosing that path would not stay open indefinitely.
The bureau has confirmed it is investigating the incident involving FBIJobs.gov, the portal through which the agency recruits and processes applicants. Officials say the inquiry is moving at full speed, with teams working "around the clock" to determine exactly how the intruders obtained the data.
A central unanswered question is where the vulnerability lay. Investigators are examining whether the attackers exploited a weakness in third-party software used by the portal, or whether they managed to penetrate the FBI's own internal systems. The distinction matters enormously: a third-party compromise suggests a supply-chain failure affecting many organizations, while a direct intrusion would raise far more troubling questions about the bureau's own defenses.
An FBI spokesperson, in a statement provided to NPR, said the bureau remains in regular contact with anyone whose information may have been caught up in the incident. That outreach is a sign the exposure could extend to a significant number of people connected to the hiring process.
ShinyHunters has built a reputation over several years as a persistent and adaptable threat. The group is generally described by security researchers as a fluid network rather than a rigid hierarchy, with participants who collaborate on campaigns and then disperse. Its specialty is data theft followed by extortion, pressuring victims to pay in exchange for keeping stolen material private or out of public circulation.
That model has proven effective because it does not depend on locking up a victim's computers, as ransomware crews do. Instead, the leverage comes from the value of the data itself. For an employer like the FBI, the material gathered through a job portal can include resumes, contact details, background information and other personal records that are difficult or impossible to replace once exposed.
The implications of such a breach reach beyond embarrassment. Applicants to federal law enforcement positions may include current government employees, military personnel, contractors and private citizens with sensitive professional histories. Their personal information, if leaked, could be used for identity fraud, targeted phishing or coercion, and in the worst case could expose individuals whose work involves national security matters.
That possibility helps explain the unusually direct tone of the FBI's public response. Rather than staying silent while the investigation unfolds, the bureau chose to issue a warning aimed squarely at the alleged perpetrators, a move that serves both as deterrence and as a signal to the public that the matter is being taken seriously.
The FBI's statement on the compromise of the FBIJobs.gov portal also indicated that the bureau is treating the incident as a serious operational security matter, examining both how the attackers gained entry and what data they actually removed. Attribution and technical forensics in cases like this can take weeks or months, particularly when attackers route their activity through infrastructure designed to obscure their origins.
Data-extortion groups have increasingly targeted employers, universities, healthcare providers and government bodies in recent years, often favoring organizations that hold large volumes of personal records. Security analysts note that these crews frequently operate across borders, which complicates efforts to arrest participants even when their identities become known.
For the FBI, the case carries added weight because the victim is the bureau itself. An agency tasked with investigating cybercrime nationwide must now defend its own systems and explain how a portal used by job applicants became a target. How quickly investigators can identify those responsible, and whether the promised pursuit yields arrests, will likely shape perceptions of the bureau's cyber capabilities.
In the meantime, the FBI says its priority is communicating with affected individuals and pressing forward with the technical work. The bureau has not publicly detailed the scope of the stolen data, leaving open questions about how many people may ultimately learn that their information was compromised.
Leatherman's message leaves little doubt about the bureau's intended posture. The video frames the pursuit as a two-way hunt, with investigators signaling confidence that they can locate the people behind the theft even as those individuals attempt to hide behind aliases and anonymizing tools. Whether that confidence translates into results will be the test in the months ahead.
(0)