---
title: "Data breach at Federal Bureau of Investigation (FBI)"
description: "On 22 September 2026, the ShinyHunters group claimed to have compromised FBI systems, with information on current and former agents as well as job applicants. The FBI said it was examining these claims concerning its recruitment website, which had become unavailable. On 6 October it explained that t"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-22-federal-bureau-of-investigation-fbi
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-22
dateModified: 2026-09-22
---
# Federal Bureau of Investigation (FBI)

Data breach — Critical

On 22 September 2026, the ShinyHunters group claimed to have compromised FBI systems, with information on current and former agents as well as job applicants. The FBI said it was examining these claims concerning its recruitment website, which had become unavailable. On 6 October it explained that the affected platform was run by a contractor that had not installed a security patch released for it, and it removed that contractor from its environment. According to sources cited by the press, the contractor would be Accenture and the software Oracle PeopleSoft, which the FBI has not officially confirmed. Samples reported by the press mention home addresses, Social Security numbers, job assignments and medical records; the number of people affected has not been established.

This information could allow a malicious third party to impersonate identities, target employees with phishing, or identify and locate them personally.

| Fact | Value |
| --- | --- |
| Disclosed on | September 22, 2026 |
| Sector | Public sector |
| Country | United States |
| Cause | Third-party provider |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Full name
- Postal address
- Employment data
- Social security number
- Health data
- Identity document
- Other personal data

## What you can do

- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Piratage du FBI : un correctif oublié chez un prestataire](https://www.zataz.com/piratage-du-fbi-un-correctif-oublie-chez-un-prestataire/) — Zataz
- [FBI Removes Contractor After Missed Patch Led to ShinyHunters Breach](https://www.esecurityplanet.com/news/news-fbi-accenture-contractor-shinyhunters-breach/) — eSecurity Planet
- [FBI blames contractor's missed patch for ShinyHunters breach](https://www.securityweek.com/fbi-blames-contractors-missed-patch-for-shinyhunters-breach/) — SecurityWeek
- [Accenture contractor removed from FBI after unpatched system led to breach](https://thenextweb.com/news/fbi-removes-accenture-contractor-data-breach) — The Next Web
- [ShinyHunters claims FBI breach and data theft](https://www.computing.co.uk/news/2026/security/shinyhunters-claims-fbi-breach) — Computing

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-22-federal-bureau-of-investigation-fbi
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees