FRONTLINEPRIVACY
Family targeting

Stolen FBI agent roster used to threaten 15+ agents and contact one agent's child in 2026

2026-01-07·Minneapolis (theft) and Schaumburg, Illinois (perpetrator)

On January 7, 2026, protesters at the scene of an FBI shooting in Minneapolis looted unsecured FBI vehicles and stole agent rosters containing home addresses, personal phone numbers, emails, and driver's-license details. Within a month, 15+ agents were getting threats. One agent was contacted by 23 different people. The agent's child was contacted on social media. A 28-year-old in Schaumburg, Illinois was charged in February.

What happened

On January 7, 2026, FBI agents responded to a Minneapolis incident in which Renee Good was fatally shot. During the response, protesters looted two FBI vehicles that had been left unsecured at the scene. The contents of the vehicles included agent rosters, FBI identification cards, building access badges, weapons, and laptops. The rosters held employees' home addresses, personal phone numbers, email addresses, and driver's-license details for FBI personnel attached to the field office. Within weeks, the data was being used. According to federal prosecutors, more than 15 FBI agents began receiving threatening messages. One agent received contact attempts from 23 separate individuals. The agent's child was contacted on social media. Suspicious activity was reported outside several agents' homes. On February 2, 2026, federal authorities charged Jose Alberto Ramirez, 28, of Schaumburg, Illinois with transmitting threats. CWB Chicago and Herald-Review reported the case.

What happened

On January 7, 2026, FBI agents responded to a Minneapolis incident in which Renee Good was fatally shot. During the response, two FBI vehicles were left unsecured at the scene. Protesters looted the vehicles. The contents reportedly included weapons, FBI identification cards, building access badges, laptops, and printed agent rosters.

The rosters carried what is, in effect, a target list. Federal prosecutors later described the exposed data as including home addresses, personal phone numbers, personal email addresses, and driver's-license details for FBI personnel assigned to the field office.

Within weeks, the consequences materialized. CWB Chicago and Herald-Review reported in early February 2026 that more than 15 FBI agents had received threatening communications tied to the stolen data. One agent was contacted by 23 separate individuals. The agent's child was contacted through social media. Suspicious activity was observed outside the homes of multiple agents. On February 2, 2026, federal authorities charged Jose Alberto Ramirez, 28, of Schaumburg, Illinois with transmitting threats.

How it started

Two failure modes lined up. The first was operational, vehicles left unsecured at an active incident scene. The second was structural, the field office still maintained printed agent rosters that carried home addresses and personal contact data in a single document. When the first failure happened, the second one made the consequences immediate and severe.

The data classes on the roster, home address, personal phone, personal email, driver's-license details, are exactly what the federal Driver's Privacy Protection Act was written to control on the DMV side. DPPA gives downstream actors who misuse DMV-derived data a private right of action with $2,500 per violation. That helps after the fact. It does not help when the data is sitting on a printed sheet in an unsecured vehicle.

The escalation pattern, an agent contacted by 23 different people and the same agent's child contacted on social media, is the family-targeting threat model. The roster gave the actor home address. From there, broker pages, social media, and reverse-lookup tools fill in the relatives. The kid is reachable because the broker page links the parent to the kid by household.

What this means for you

If you're a federal agent, FBI, ATF, DEA, ICE, or any field officer whose home address might appear on an agency roster, this case is the worst-case answer to the question "what happens when an agency dataset leaks." Every minute the roster is in circulation, every channel that lets an attacker convert a name into a residence is a path. Brokers are the path that runs every day, every aggregator, and every re-listing.

Federal personnel currently have no broker-removal statute equivalent to NJ's Daniel's Law or the federal Lieu Act (the federal law covers federal judges only). The defensive layer is continuous broker removal across every commercial site that lists residences. We file opt-outs across 200+ broker sites and re-check every two weeks. When a roster leak happens, the broker side is what the attacker uses to translate a name into a doorstep. Closing those channels in advance shortens the chain.

Editorial rules: Only public, already-reported incidents. Never name a non-public victim. Always end with the prevention takeaway tied to our service. Cite at minimum one public source per claim.

What would have prevented this

This is the cleanest case in the dataset of how the data layer plus a moment of operational failure produces immediate physical-world targeting. The roster contained data classes that DPPA explicitly protects, driver's-license numbers among them, but DPPA enforcement is downstream and after-the-fact. The exposure happened upstream, in a single unsecured-vehicle moment, and the data was usable instantly. For sworn personnel, the implication is that any concentrated dataset of officer home addresses, whether on a roster, a personnel system, a county recorder portal, or a broker page, is a single failure away from doing this. The federal Lieu Act covers federal judges only. There is no federal Daniel's Law for FBI agents or other federal LE. The continuous, defensive layer is broker removal across every commercial channel that holds the same address data the roster did. Once enough channels are closed, even a roster theft has fewer downstream paths into a doxxing attempt.

Run a free scan. No signup.

Public sources