What should I do immediately after a data breach?

Change your password for the affected account and any other account where you reused that password. Enable two-factor authentication. Monitor your bank and credit card statements. Place a free credit freeze at Equifax, Experian, and TransUnion. If your Social Security number was exposed, file an identity theft report at IdentityTheft.gov.

How long do companies have to notify me after a data breach?

In the US, notification timelines vary by state — typically 30 to 90 days after a breach is confirmed. Under GDPR in Europe, companies must notify regulators within 72 hours. Many states require individual notification "in the most expedient time possible." Companies often delay notification while investigating.

Should I freeze my credit after a data breach?

Yes. A credit freeze prevents new accounts being opened in your name without your explicit unfreeze. It is completely free at all three major bureaus, does not affect your credit score, and does not impact existing accounts. Unfreeze temporarily when you need to apply for credit, then refreeze immediately.

Hackers Stole 5,000 FBI Agents' Home Addresses and SSNs From a Job Website

The FBI's Job Portal Got Hacked. Your Data Was Already at Risk.

On September 22, 2026, a hacking group called ShinyHunters announced it had broken into FBIJobs.gov, the official portal where people apply to work at the Federal Bureau of Investigation. The group claimed to have walked away with 2 to 3 terabytes of data covering agents, staff, and job applicants. Four days later, the FBI confirmed a "cybersecurity incident" and took the site offline entirely.

This is not a story about espionage or nation-state hackers with limitless resources. This is a story about a vulnerability in a piece of software that thousands of organizations use, and a firewall that apparently was not doing its job.

How Did They Get In?

ShinyHunters says they exploited a vulnerability in Oracle PeopleSoft, a widely used HR and recruiting platform, combined with a simple firewall bypass. PeopleSoft runs payroll, benefits, and hiring workflows at universities, hospitals, government agencies, and corporations worldwide. It is enterprise software. It is supposed to be hardened.

The word "simple" in their description is the part that should bother you. They did not claim to use a sophisticated zero-day exploit developed over months. They found a known weakness and slipped past a firewall that should have stopped them. That gap, between what a security system is supposed to do and what it actually does, is where breaches live.

The FBI did not catch it. They confirmed the incident four days after the hackers announced it publicly.

What Was Taken?

ShinyHunters posted a 5,000-record sample to demonstrate the breach was real. Those records contain names, home addresses, phone numbers, and information about agents' spouses. The full dataset, which the group claims covers almost all FBI agents, reportedly includes Social Security numbers and job titles.

Think about what that combination means in practice. A name and address tells you where someone lives. Add a phone number and you have a direct line. Add a spouse's information and you have leverage. Add a Social Security number and you have the key to someone's financial identity. That is not just a data breach. That is a dossier.

ShinyHunters set a 7-day extortion deadline. They threatened to release the full dataset if their demands go unmet. As of the FBI's confirmation on September 26, 2026, the portal remained offline.

Sources: TechCrunch, The Hacker News.

Why Does This Matter to You?

You did not apply to the FBI. But you have applied for a job somewhere. You have created an account on a hiring platform, a bank portal, a healthcare provider's patient system, or a government website. Every one of those portals asked for your personal information. Many of them asked for your Social Security number. All of them run software with known and unknown vulnerabilities.

The FBI has a cybersecurity division. It investigates breaches for a living. If its own recruiting portal can be compromised through an enterprise software flaw and an inadequate firewall, the HR portal at your local hospital or the benefits system at your employer is not in better shape.

Your SSN does not expire. It does not change. Once it is out, it is out forever. And it is almost certainly already in more databases than you realize.

What to Do Right Now

Freeze your credit. Go directly to Equifax, Experian, and TransUnion and place a freeze on your credit file. It is free. It blocks anyone from opening new credit in your name, even if they have your SSN. Unfreeze it temporarily when you need to apply for something, then refreeze it.
Set up fraud alerts. Even with a freeze, a 90-day fraud alert adds a layer of verification to any account inquiry. You only need to file with one bureau and they notify the others.
Check Have I Been Pwned. The site haveibeenpwned.com lets you enter your email address and see which known breaches included your information. It is free and it does not require an account.
Use a password manager and stop reusing passwords. If a portal you used five years ago was part of a data sale, and you used the same password there as you do on your email or bank account, your exposure multiplies fast.
Enable two-factor authentication everywhere it matters. Use an authenticator app, not SMS, for anything financial or identity-related. SMS codes can be intercepted. Authenticator apps cannot.
Consider a data-removal service. Companies like DeleteMe or Privacy Bee find and remove your personal data from data broker sites. It does not stop breaches, but it reduces how much information is publicly available to combine with stolen data.
Watch for targeted phishing. If this breach data circulates, attackers will use it to craft convincing calls and emails. An FBI agent's spouse receiving a call from someone who knows their home address and their partner's job title is a social engineering target. So are you, with whatever data is already out there about you.

The Truth No Security Dashboard Will Show You

Every organization that collects your personal information is making a promise it may not be able to keep. The FBI made that promise to its own employees. It ran a portal on widely used enterprise software. It had firewalls. It had a cybersecurity workforce. And it still took four days to confirm what hackers announced publicly.

The problem is not that the FBI is careless. The problem is that the attack surface is enormous, the adversaries are persistent, and no system is immune. We have built an economy that requires you to hand over your most sensitive identifiers, your SSN, your address, your date of birth, to websites in exchange for the opportunity to apply for a job, open a bank account, or get healthcare. And then we act surprised when those websites fail.

You cannot opt out of the digital identity system. But you can take the steps above and reduce what happens when the next portal goes down.

Do this now:

Freeze your credit at all three bureaus (free, takes 10 minutes)
Check haveibeenpwned.com for your email addresses
Enable authenticator-app 2FA on your email, bank, and any government accounts
Review any job sites or HR portals where you submitted a Social Security number