Hackers Say They Stole FBI Agents' Home Addresses. Here's What a Criminal Can Do With Yours

On September 22, the FBI's jobs portal stopped showing job listings. In their place was a fake seizure banner announcing that the site now belonged to ShinyHunters, a theft-and-extortion crew the bureau had warned companies about only months earlier.

The defacement was the noisy part. What the group said next mattered more. ShinyHunters told reporters it held "very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job." As proof, it handed newsrooms a spreadsheet of about 5,000 alleged FBI employees. According to 404 Media, Reuters and others who reviewed it, the rows included names, home addresses, phone numbers, dates of birth and, in some cases, details about spouses. Reuters reported that the sample also contained Social Security numbers and emergency contacts.

We don't want to overstate this. The FBI has acknowledged the claims and says it is "actively and aggressively investigating." It has also said it hasn't yet determined whether the breach happened in its own systems or at a third-party provider that supports FBIJobs.gov. Reporters who examined the sample said parts of it appear real, but that doesn't prove every personnel file was taken. In its May advisory on the group, the FBI itself warned that extortion crews sometimes exaggerate what they've stolen.

Still, consider who was targeted: some of the most security-conscious people in the country. If their home addresses can end up in a criminal's spreadsheet, yours can too. So the useful question isn't whether your information has leaked. It's what a criminal can do with it.

The leak is half the kit. The county supplies the rest

A breached record on its own is a list of facts about you. Paired with free public property records, it becomes a plan.

From the breach: your full legal name, date of birth, phone number, home address, sometimes your Social Security number, and sometimes your spouse's name.

From the county, for free: whether you own the home, how title is held, and who the co-owners are. Many counties also show the recorded deed itself, which reveals your signature, the format of a valid conveyance, the legal description of the parcel, and whether there's a recorded mortgage. New Hampshire's Attorney General, for example, notes that every county there runs a register of deeds website where anyone can search property records by owner name. Most states work the same way.

Put those together and a criminal has nearly everything needed to draft a convincing deed transferring your home to someone else. The spouse details matter more than they seem to. If a home is held jointly, a forger needs both names to make a transfer look legitimate, and the breach supplies the second one.

How a stolen-data profile turns into a stolen house

Deed fraud, sometimes called title theft or quitclaim fraud, doesn't need a locksmith. It needs paperwork. A typical scheme runs like this:

1. Pick a target. Scammers favor properties that are easy to move without anyone noticing. In the American Land Title Association's 2026 seller impersonation study, 72% of title firms said absentee-owner homes such as vacation properties were typical targets, and 68% pointed to homes with paid-off mortgages. Fraudsters most often posed as sellers of vacant land (82%). County records show which homes have no recorded mortgage. A breach that lists your mailing address can show whether you actually live at the property.

2. Forge and file. The fraudster forges your signature on a deed and records it. In some counties, as HomeLight explains, that can be as simple as submitting the forged document with a small recording fee, and the public record of ownership changes almost immediately. Recorders generally don't investigate what they're filing. In California, county recorders do not, and legally cannot, vet the contents of a deed.

3. Impersonate you. To sell the home or borrow against it, the criminal has to act as the owner through a title company or lender, and the leaked data helps here. Fraudsters use fake IDs and remote closings where the parties never meet in person, according to New Hampshire's Attorney General. In ALTA's study, 88% of title firms said demands for mail-away signings or the seller's own designated notary were a frequent tactic. Cash deals and properties with no mortgage lien were each flagged as common warning signs by well over 80% of firms.

4. Cash out. Once the fake deed is on record, the scammer can sell the property, take out a mortgage on it, or rent it out for profit, often before the real owner knows anything happened. Many owners find out only when a bill shows up for a loan they never took or a lien is filed against the home.

And it's getting worse. ALTA found that 59% of title firms faced at least one seller impersonation attempt in 2025, more than double the 28% reported in its 2024 survey. Nearly a quarter reported three or more attempts in the month before the survey, compared with 4% two years earlier. In its 2025 Internet Crime Report, the FBI's IC3 logged 12,368 real estate fraud complaints and more than $275 million in losses, up from 9,359 complaints and about $173 million the year before. That category also covers rental and timeshare scams, so it isn't a pure deed fraud count, but the trend is clear.

Check that your home is still in your name

1. Search your county's land records. Go to your county clerk, recorder or register of deeds website and search by your name and by your property address. Look at the most recent recorded document. If it's your original deed or your current mortgage, good. If it's a deed, quitclaim, mortgage, lien or power of attorney you don't recognize, act right away.

2. Search every name variation. Try your name with and without a middle initial, plus your spouse's name and any trust or LLC that holds property for you. Forgers don't always spell things the way you do.

3. Check every property you own. Second homes, inherited parcels, vacant lots and rentals carry the highest risk because no one is there to notice a stranger's mail or a "For Sale" sign. If you're handling property for an elderly parent, check theirs as well. Homes owned by older people are frequent targets.

4. Pay attention to the mail. Loan statements, payoff letters, tax notices with a changed mailing address, or a title company asking about "your" sale are all red flags.

5. Enroll in your county's alert, if it has one. Many recorders now offer free notifications. In Linn County, Iowa, for example, the recorder emails, texts or calls you when a document with your name is recorded. Greene County, Ohio, lets you register several name variations, including a spouse's. Sign up wherever you own property.

6. If something is wrong, move fast. Report it to local law enforcement, notify the county recorder, and call a real estate attorney to start the recovery process. Contact your lender and title insurer too.

Why a one-time check isn't enough

A records search is a snapshot. It tells you your title was clean this morning. It can't tell you what gets filed tonight. The FBI breach is a reminder that your data can leak at any time, and you won't get notice. A forged deed can be recorded the same way.

County alerts are a real step forward, and we encourage everyone to use them. But they have limits. They vary from county to county. Not every county offers one. Each covers only the records in its own office. And as Linn County's own recorder notes, an alert can't prevent fraud. It only gives you early warning. If you own property in more than one place, or you just don't want your protection to depend on whether your county has signed up for a program, you need something that follows your title wherever it's recorded.

That's why we built DeedLock, the original AI Title Surveillance. It watches county property records around the clock and alerts you the moment something is filed against your title, so a forged deed gets caught before anyone sells your home or borrows against it. Because criminals with stolen identity data will try to switch off protection, cancelling DeedLock requires identity verification. Someone holding your name, birth date and phone number still can't turn it off.

For the lenders, title companies, agents and attorneys we partner with, it's a way to keep protecting clients after closing.

The bottom line

ShinyHunters may or may not have taken everything it claims. But the method it described isn't exotic. Breach the data, match it to free public records, and you have a ready-made profile of a homeowner. The defense is just as simple: check your title now, and make sure someone keeps checking after you close the browser tab.

Check your county records today. Then visit goldpatrons.com to put your title under DeedLock surveillance, so you're the first to know if anyone ever files against your home.