The sample was five thousand

“Almost all FBI agents” is a sentence on a leak site. It is not a row count.

ShinyHunters posted that line today, addressed to Brett Leatherman and Kash Patel. They say Criminal Justice, HR, Medlink, “and more” are in the pile, plus everyone who applied for a job. The price is not money. It is one week to delete a May IC3 advisory that described harassment, family contact, swatting, and claims of compromising photos. They deny all four, and they deny being sextortionists while they threaten the agency with its own people.

404 Media was shown a sample on about 5,000 agents: names, home addresses, phones, spouses. Portions of that sample checked out. The rest of the claim — all agents, all applicants, those internal systems — has not. They told The Register the door was a new Oracle PeopleSoft bug and that they defaced FBIjobs.gov. There is no public write-up of that bug. The FBI told Reuters it is aware of claims about unauthorized activity on FBIjobs.gov and is investigating. The jobs page now says maintenance.

What a banner does not prove

A seized splash on a recruiting site is write access to that site. It is not HR. It is not Medlink. It is not “almost all.” A verified slice of home addresses is a different, smaller, worse fact: someone can call the spouse.

Applicants are a third population. A person who filed a form in 2019 is not an agent. If the applicant table is real, the exposure is old PII, not a badge. Do not collapse those into one headline called “the FBI was breached.”

If the address is yours, or your officer’s

Do not argue with the post. Ask whether your row is in the sample that was actually shown: name, home, phone, spouse. Treat a call to the household as the incident, not the onion page. The May advisory they want deleted is the one that warned victims about exactly this pressure. Removing it does not unpublish a spreadsheet.

I still do not treat a leak-site paragraph as the dataset. Five thousand checked rows are a dataset. “Almost all” is the shakedown.