Personal data on an unknown number of current and former FBI agents, their spouses and applicants to the bureau has allegedly been stolen by a cybercrime group.
The apparent hack of the nation’s top law enforcement agency not only compromises individual agents’ data; it could also have national security implications. Stolen personal information could be used to influence agents engaged in sensitive investigations or target their family members.
Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™
Point phone camera here
A group known as ShinyHunters claimed Tuesday to have stolen data on “all FBI employees and applicants.” The claim came as the FBI’s jobs website was defaced with a message from ShinyHunters saying the hackers had “seized” it.
404 Media first reported the hack.
Software vulnerability exploited
The stolen material reportedly includes the names, home addresses and phone numbers of an undisclosed number of FBI agents. The hackers also stole information on agents’ spouses, the hackers said.
404 Media said it received a sample of the data. The outlet’s analysis found that the data appeared to be legitimate, containing personal information on 5,000 FBI employees.
The hackers reportedly infiltrated the FBI’s website through a previously unknown vulnerability in Oracle’s PeopleSoft, a software suite commonly used to store job applicants’ and employees’ data. From there, the hackers said they gained access to government servers hosted by Amazon Web Services and exfiltrated between two and three terabytes of data.
In a statement on the defaced FBI jobs website, apply.fbijobs.gov, ShinyHunters said they also stole protected health information not only from applicants but also from the bureau’s current and former agents.
“All FBI data was compromised including sensitive PII/PHI on incumbent and former employees and all application information,” the group wrote.
The bureau later replaced the hackers’ message with a statement that the jobs site was “down for maintenance.” The FBI said that it “is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”
‘Severely offended’
After the defacement, ShinyHunters released a statement on their dark web leak site. It accused the FBI of making false claims about the group. The statement, addressed to Assistant Director Brett Leatherman of the FBI Cyber Division and FBI Director Kash Patel, said that the bureau “made substantial false allegations regarding our organization” in a public report from May.
In the report, the FBI said the hackers often use “real or exaggerated claims of access to sensitive or personal information” as well as “harassment strategies” to extort its hacking victims. ShinyHunters denies the characterization.
“We have been severely offended,” the group wrote. “We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to ‘disrupt’ our operations, an effort that ultimately proved unsuccessful.”
In a statement to Straight Arrow via email, a member of ShinyHunters reiterated that the group does not exaggerate when communicating with victims.
“As we have stated we don’t exaggerate, lie or bluff,” the member wrote.
The hackers’ dark web post provided further details about the data allegedly stolen in the breach.
“We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,” the post said. “Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink and more.”
ShinyHunters have given the FBI one week to “correct or simply REMOVE” the report. When Straight Arrow asked whether the group plans to release all the data after the deadline passes, the member said the group has “no comment as of now.”
The attack is one of the most high-profile yet for the cybercrime group, which earlier this month leaked more than 600,000 files, including passports, driver’s licenses, Social Security cards and even the driving record of deceased sex offender Jeffrey Epstein, from the Florida Department of Highway Safety and Motor Vehicles.
Round out your reading
- Lawyer says 57 Cornell frat members were in the group chat. Could their silence be a crime?
- Florida county discovers mysterious Flock cameras with no obvious owner.
- Off Script: They won their primaries on one message. Now it’s disappearing.
- Some question whether a popular affordable housing policy is making the nation’s home shortage worse.
- Kelvin wave incoming: Why the US should care.
