The FBI tells staff their data was taken while publicly calling the theft undetermined

TechCrunch reported on 28 September that the FBI had told agents and support staff their personal information was stolen in a recent attack on the bureau’s job application portal, the first such acknowledgment to employees. The account rests on reporting by Ken Dilanian of MS Now over the weekend, which said the bureau had internally declared a “cyber security incident” and told employees their names, addresses, job titles and Social Security numbers were exposed. That is a single-source chain, relayed. The FBI’s only public language remains its statement of the previous week that it was aware a hacking group had claimed an attack but that data theft was “still undetermined.” No attribution to any state actor has been captured, and the gap between what employees are being told and what the bureau says publicly is itself the story.

The claims already on the board are separate, and should not be merged with it. The National reported on 2 September that the Iran-linked group Handala claimed to have breached California Water Service and hacked FBI director Kash Patel’s personal email and cloud services — claimed, not confirmed. Threat Beat reported on 9 September that a group calling itself APT IRAN claimed responsibility for an AT&T outage across Texas cities, vowed to intensify critical-infrastructure attacks before the 9/11 anniversary, and claimed a water utility breach via Telegram; the outage reports were Downdetector-based and no confirmation was captured. NBC News reported on 2 September, citing four people with access to government and industry threat information, that Iranian hackers had targeted US water, telecommunications and energy infrastructure and had so far been unsuccessful.

The confirmed baseline sits further back. A joint FBI, CISA, NSA, EPA, Energy and Cyber Command advisory, AA26-097A, published 22 July, records that IRGC-CEC-affiliated actors known as CyberAv3ngers compromised at least 75 US-based Unitronics PLC and HMI devices across multiple critical-infrastructure sectors in a campaign beginning November 2023. Against that, much of what currently ranks as live regional threat intelligence is not. SOCRadar’s Iran–Israel cyber conflict dashboard states on its own page that its map and incident data were last updated in March 2026 and the page on 6 April, including an unverified Z-PENTEST Alliance claim of control over a water-treatment system that SOCRadar itself describes as unconfirmed. Every current figure on Iranian connectivity available to this desk dates to May.

Assessment: Two incentive structures are working against the reader here. Breached institutions hedge in public and disclose in internal memos, so the honest version reaches employees before it reaches the record. Hacktivist brands do the reverse: they publish maximal claims on Telegram because the claim, not the access, is the product, and an unfalsified claim ages into a citation. The connective tissue is the aggregator layer, where six-month-old dashboards and 2018 reports surface with fresh timestamps. The discipline for the next 48 hours is narrow: does the FBI confirm the portal breach in public, and does any actor claim survive contact with evidence. Until then, nothing links Iran to it.