In October 2026, a hacker claimed to have leaked 469,169 records from CJIS Online, a training platform used by the FBI for law enforcement training. A pirate publication known as zataz announced the release of data supposedly originating from CJIS Online, a service providing training on CJIS security policy for the FBI. The claimed dataset would include users associated with 23,076 organizations and service providers, with names, contact information, and account statuses. This potential exposure of data could have significant implications for the American judicial and law enforcement ecosystem. However, the details provided do not confirm the authenticity of the entire dataset, its extraction date, or the method of acquisition. This announcement follows a claim of access published in August 2025, but no clear connection has been established between the two events. Professional contact information and affiliations exposed in the October 2026 announcement, analyzed by zataz, describe CJIS Online as a platform used by American police for training on compliance with CJIS security policy. This should be distinguished from systems that contain judicial information or operational investigation data. A leak of training accounts does not, by itself, indicate an intrusion into the FBI's criminal databases. According to the publication, the file would contain 469,169 user records, distributed among 23,076 organizations and service providers. The scope announced includes FBI offices, sheriff's services, police departments, courts, prosecutors' offices, and companies providing technology to the judicial sector. The author claims 248,825 unique email addresses, including 35,256 in .gov (government) and 861 in .mil (military), as well as 208,918 phone numbers. These numbers remain declarative, and the message does not specify whether the counts by extension concern unique addresses or occurrences (duplicates, etc.) in the file's lines. The announced distribution distinguishes 257,081 active accounts and 212,088 inactive accounts. The columns presented cover the user identifier, various components of the name, email address, phone number, organization, profile type, and activation status. No password field appears in the structure provided. The announcement therefore describes an exposure of information about users, without demonstrating possession of their authentication means. It would be foolish to assume that there is no physical and digital two-factor authentication to access the information... I hope so! The excerpt provided associates profiles with a unit of the US Air Force, a service of the Bureau of Indian Affairs, a municipal police department, an FBI office in New York, and a sheriff's service. The visible categories include computer profiles and service providers. These affiliations are those displayed in the sample; their accuracy and currency remain to be verified. The stakes go beyond a simple address book. Names linked to roles, organizations, and professional contact information could facilitate targeted phishing attempts or impersonation of partners. This is a risk inferred from the nature of the fields announced, not an exploitation observed by zataz. From 2021 to 2025, distinct incidents occurred. In November 2021, an incident had already exposed a weakness in a service related to the CJIS environment. The hacker Pompompurin (founder of Raid Forum and currently in prison) had claimed to have used the LEEP portal to send false alerts from an FBI infrastructure. The messages presented the researcher Vinny Troia, founder of Shadowbyte, as responsible for imaginary attacks. According to historical elements transmitted, Spamhaus had identified two waves of sending, with an estimated reach of at least 100,000 email boxes. Recipients would have been selected from ARIN data. The use of a legitimate infrastructure gave the messages an especially misleading institutional appearance. According to Pompompurin's explanations at the time, parameters controllable from the browser allowed the subject and content of the confirmation emails to be modified, then to automate their sending. The FBI had acknowledged a software misconfiguration, specifying that the concerned server was dedicated to LEEP notifications and separated from its professional messaging. In 2023, the hackers of BlackHat accessed the machines of the US justice system. In 2024, the hacker CarBanak had released hundreds of documents, including some from LockBitSupp. In August 2025, on DarkForums, the hacker l33tfg announced that he had access to CJIS. No elements transmitted at the time, however, demonstrated that it targeted CJIS Online, that it was authentic, or that it led to the extraction of the 469,169 records that l33tfg displayed in his small advertisement. In March 2026, the FBI confirmed the hacking of the messaging system of its director.