The bureau said incident

“Aggressively investigating” was Wednesday. A cybersecurity incident is a different sentence.

Reporting over the weekend, including NewsNation, NBC, and PBS, carries the bureau’s line: it is aware of a criminal group claiming a compromise of the FBIJobs.gov portal and an impact on employee personally identifiable information. The point of breach is still undetermined — a third party that supports the jobs site, or the FBI’s own enterprise. They say they are working with those providers. They have not authenticated the medical files, the terabyte figure, or MedLink.

That narrowing matters. A jobs portal and a personnel-health system are not the same door. Confirming that a claim exists, and that an incident is being worked, is not confirming the inventory the group posted.

What changed since the sample note

The 23 September note was a leak-site paragraph plus about 5,000 rows a reporter checked in part. The 26 September note was a handful of medical pages Reuters could partly anchor. Today’s fact is institutional: the bureau has stopped speaking as if this were only a blog post, and it has not started speaking as if every system named on that blog is down.

Vendors in the path are now an explicit branch of the investigation. If the jobs site is a contractor’s application, the employee row can leave without the bureau’s own domain controller ever being the story. That is the Revolut mailbox shape again: the channel that holds the file is not the institution’s core.

What not to collapse

Do not brief “the FBI was fully breached” off a jobs-portal sentence. Do not brief “nothing happened” because MedLink is unconfirmed. Ask which system the bureau has actually loss-assessed, and keep the reporter-checked pages in a separate pile from the systems nobody has verified.

An incident can be real at the portal and still be a fiction at the clinic. Both errors are available today.