Three members of the FBI’s secretive hacking unit, known as the Remote Operations Unit (ROU), have had their identities exposed after a breach of the bureau’s data by the cybercrime group ShinyHunters. The hack, which also saw the FBI jobs website defaced, reportedly resulted in the theft of between two and three terabytes of data on nearly “all FBI employees and applicants.”
On Tuesday, as first reported by 404 Media, ShinyHunters used a software exploit to gain access to a government cloud server and steal information including the names, job titles, Social Security numbers, addresses, badge numbers, dates of birth and phone numbers of current and former FBI employees, applicants and in some cases their spouses.
Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™
Point phone camera here
ShinyHunters has been active since 2019 and is known for hacking and extorting high-profile victims, which have included Microsoft, AT&T Wireless, Ticketmaster, Pornhub and Rockstar Games. The cybercrime group is known for utilizing zero-day exploits, voice phishing and other types of social engineering attacks in order to gain access to sensitive information, which is often sold or leaked on the dark web.
Information on the three ROU members was located by 404 Media within a sample of the hacked data, which contained details on a total of 5,000 FBI employees. The highly secretive ROU is best known for developing hacking tools used against criminals on the dark web, although it has in recent years shifted towards national security investigations.
Aside from the ROU members, Reuters reported on Wednesday that the sample data also exposed information on FBI employees tasked with investigating Chinese spies, Russian intelligence and drug cartels, among others. At least 11 of the entries were for employees working undercover in human intelligence roles.
The FBI said in a statement that it “is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII). While the point of breach is still undetermined — whether a third-party or the FBI’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.”
In a post to their dark web leak site, ShinyHunters said that the breach was carried out in response to a public service announcement from the FBI in May in which the bureau accused the cybercrime group of often using “harassment strategies” and “exaggerated claims of access to sensitive or personal information” in order to extort its hacking victims.
ShinyHunters described the FBI’s characterization as “disinformation” as part of “an attempt to ‘disrupt’ our operations.” In a statement to Straight Arrow, a member of the cybercrime group said they “don’t exaggerate, lie or bluff.”
The hackers have demanded that the FBI either “correct” or “remove” the public service announcement.
On Thursday, however, ShinyHunters deleted its remarks regarding its justification for the hack. In a new post, the cybercrime group said it had no further comments to make and that it was “highly confident” that it had “achieved our goal.”
The hackers have not said whether the alleged two to three terabyte data cache of FBI data will be made public, but have given the FBI five days to comply with its demands.
“There is 5 days remaining still,” ShinyHunters wrote. “We have no comment yet regarding what we will do if the victim entity does not comply with our kind request.”
Round out your reading
- Lawyer says 57 Cornell frat members were in the group chat. Could their silence be a crime?
- Florida county discovers mysterious Flock cameras with no obvious owner.
- Off Script: They won their primaries on one message. Now it’s disappearing.
- Some question whether a popular affordable housing policy is making the nation’s home shortage worse.
- Kelvin wave incoming: Why the US should care.
![[your]NEWS logo](https://groundnews.b-cdn.net/interests/fb6dc495f74049f513563c33352175eaa0ecd509.jpg)
