ShinyHunters, the hacking group that knocked Fulton County Schools' Canvas learning platform offline in April, claims it breached the FBI's online recruiting portal and stole personal data on thousands of bureau employees.

The FBI said Sept. 23 that it is investigating a claim that FBIJobs.gov was compromised and that employee personal information may have been affected. The bureau said the point of entry has not been determined.

WSB-TV reported the connection between the FBI breach claim and the Canvas attack that disrupted Fulton County Schools (FCS), Georgia Tech, Emory University and other metro Atlanta districts.

ShinyHunters released a sample of about 5,000 records to journalists. The sample included names, home addresses, phone numbers, dates of birth, Social Security numbers and emergency contact details, according to ASIS International, citing Reuters reporting. Reuters said it verified details for more than 22 people by cross-referencing credit records.

The group claims to hold data on roughly 38,000 FBI staff, according to BBC reporting cited by Tech Insider. The FBI has not confirmed any specific record count.

In an internal memo reported by The New York Times on Sept. 28, FBI leadership told staff: "We are operating under the premise that the threat actor is also exfiltrating PII of all F.B.I. employees."

"For the FBI to have a hack like this is majorly embarrassing at a minimum, and potentially catastrophic for agents," Emsisoft threat intelligence analyst Luke Connolly told WSB-TV.

ShinyHunters said the attack was retaliation for an FBI advisory issued in May that labeled the group "threat actors" who exaggerate their claims to pressure victims into paying ransoms. The group demanded the FBI retract the advisory rather than pay a ransom, LiveNow FOX reported.

ShinyHunters told CBC News on Sept. 29 that it "was never planning" to release the FBI data. The group said it could not guarantee samples already shared with reporters would stay private, Tech Insider reported.

What this means for FCS families

The FBI breach is the second major ShinyHunters attack to touch the Alpharetta and Milton area in 2026. The group claimed responsibility for breaching Instructure, the company that owns Canvas, in an attack first detected April 29. FCS took the platform offline and alerted parents, students and staff, according to FOX 5 Atlanta.

ShinyHunters claimed the Canvas attack affected nearly 9,000 schools worldwide and compromised personal information on approximately 275 million people. FCS officials said the breach involved names and internal messages but that passwords, Social Security numbers and financial information were not believed to be compromised.

Instructure later said it reached an agreement with the attackers and received digital confirmation the data had been deleted, though the company acknowledged there is "never complete certainty when dealing with cyber criminals," Inside Higher Ed reported.

Doug Thompson, chief education architect at Tanium, said in May that attackers "are moving up the data supply chain to the platforms that sit underneath thousands of institutions at once" rather than targeting individual campuses.

Google's Mandiant published research showing ShinyHunters is targeting a vulnerability in Oracle's PeopleSoft human resources software. A patch was released, but some customers relied on firewall protections that ShinyHunters managed to bypass, NPR reported.

FBI response

FBI Assistant Director Brett Leatherman posted a video warning ShinyHunters members directly. Dutch authorities arrested a suspected member of the group before the FBI breach claim surfaced, NPR reported.

Cynthia Kaiser, former FBI deputy director of the cyber division and head of ransomware research at Halcyon, called ShinyHunters "reckless" for targeting the bureau.

No statement from Fulton County Schools addressing the FBI breach or its implications for the district's 83,000-plus students has been released. Thompson warned in May that stolen Canvas data could fuel targeted phishing: "With access to real names, email addresses and even teacher-student messages, the next wave of phishing will not be generic."