ShinyHunters claims hack of FBI workforce data, agency says it is investigating

The Federal Bureau of Investigation has acknowledged a data breach that appears to expose personal and sensitive records for thousands of its staff, the BBC reported on Friday.

The FBI said it was “aggressively investigating” how the incident occurred, according to BBC News. The same BBC report said the hacking group ShinyHunters claims to have breached FBI systems and is threatening to publish the stolen databases and documents within four days unless its demands are met. The BBC story is here: BBC News.

Current and former FBI agents who spoke to the BBC expressed shock, fear and anger. One former agent told the BBC, “This is really bad for our undercover agents,” and said colleagues feared their personal information could be used by criminals or hostile states to target them.

The BBC said ShinyHunters shared samples of the alleged stolen data with reporters and that the samples appeared genuine. Those samples reportedly include names, home addresses, phone numbers, badge numbers, job titles and information about spouses. The BBC also reported that the attackers appear to possess fitness-for-work medical examinations containing blood and urine test results and doctors’ notes mentioning conditions such as a “shellfish and banana allergy.”

Agents told the BBC they fear the information could be used to create convincing phishing attempts, scams or demands for bribes. A former cyber investigator quoted by the BBC said group chat discussions included worry about “violence-as-a-service” attacks from young online gangs that could harass agents investigated by those gangs.

The BBC account said groups similar to ShinyHunters have previously been linked to swatting incidents and even petrol bomb attacks against law enforcement officers and rivals. The hacking group is not, the BBC reported, demanding money. Instead it is said to want the FBI to retract an advisory published in May, which the group says offended it.

Some former and current staff told the BBC they were angry about what they described as “sloppy and lazy security failures” that allegedly enabled the breach. The report also quoted security professionals who warned the breach could expose agents’ family members and carry national security risks, including potential recruitment efforts by hostile foreign intelligence services.

The BBC said the FBI had not responded to its requests for comment before the agency issued the acknowledgement that it was investigating. The report added that some staff had been advised to sign up to a service called DeleteMe to remove personal information from data broker websites, a suggestion that a former cyber investigator described to the BBC as inadequate.

Featured image: Tony Webster from Minneapolis, Minnesota, United States via Wikimedia Commons, CC BY-SA 2.0.