FBI investigates claim by hackers they stole data on all agency staff
The FBI says it is investigating a reported breach of its system after a cybercrime group, Shiny Hunters, claimed to have stolen sensitive information on thousands of bureau personnel.
The hackers say they now hold private data on all the bureau staff - around 38,000 people - including anyone who applied to join the investigative agency. The group claims to possess every agent's name, role, badge number, and personal details including home address, phone numbers, and spouse information.
In a statement posted on X, the FBI acknowledged the claim, stating they were "actively and aggressively investigating the matter".
The criminals claim to have breached the FBI's servers on Monday night and began contacting reporters on Tuesday, sharing samples and screenshots of the stolen data. The BBC has viewed a small portion of the data, which appears genuine.
According to Reuters, the data contains details about officials' job assignments, including sensitive work against Chinese spies, Russian intelligence, and drug cartels.
ShinyHunters is an international collective of hackers, initially believed to have originated in France. They have been responsible for several high-profile breaches, including attacks on Rockstar Games in April and the education platform Canvas in May.
The group claims to have exploited a vulnerability in the Oracle cloud storage system used by the FBI, breaching multiple systems including FBIJOBS, FBI BEAST (which conducts background checks on employees and applicants), FBI MedLink (holding agent medical records), and FBI BICS (holding investigation information).
Unlike previous attacks motivated by financial gain, ShinyHunters states they did not hack the FBI system for money. Instead, they are demanding the agency retract an advisory issued in May characterising them as "threat actors". The group claims they were "offended" by the description and argues that they often "use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims".
The FBI did not respond to the BBC's requests for comment.
In its statement on X, the agency revealed they are investigating whether the hackers breached their systems directly or those of a third party.
"We are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk," the post said.
A cybersecurity expert characterised the attack as a "retaliation" move, demonstrating that "no organisation is safe from the group".
"The group clearly wants to control the narrative around their activities, ensuring nothing is said that could dent their reputation," said William Wright of Closed Door Security.