The FBI confirmed it is investigating a claim by a hacker group known as ShinyHunters that they have breached the bureau's systems and stolen sensitive personnel data. The cybercrime group alleges it possesses private information on approximately 38,000 FBI staff and applicants, including names, badge numbers, home addresses, phone numbers, and details about spouses.
The hackers reportedly began contacting reporters on Tuesday, sharing samples of the data they claim to have obtained after allegedly breaching FBI servers on Monday night. A portion of the shared data, reviewed by the BBC, appears to be authentic. According to Reuters, some of the compromised information includes details about officials' job assignments, such as sensitive operations targeting Chinese spies, Russian intelligence, and drug cartels.
ShinyHunters, described as an international collective of hackers, has previously claimed responsibility for other high-profile breaches, including incidents involving Rockstar Games and the education platform Canvas. The group claims to have exploited a vulnerability in Oracle's cloud storage system, which the FBI uses for multiple applications including FBIJOBS.gov, background check systems, medical records, and investigation data.
In a statement posted on X, the FBI acknowledged the claim and stated that the agency was "actively and aggressively investigating the matter." The bureau indicated it was working closely with third-party providers supporting FBIJobs.gov to mitigate risks. The FBI also stated it was working to determine whether the breach occurred on FBI systems or those of a third-party provider.
The hackers stated their motive was not financial. Instead, they demanded that the FBI retract an advisory issued about the group, which ShinyHunters deemed inaccurate. The FBI's public service announcement described ShinyHunters as "threat actors" who leverage claims of data access for financial gain, targeting major companies across various sectors and often stealing millions of customer records. ShinyHunters has given the FBI one week to address their demands or threatened to release the full databases.
A cybersecurity expert told the BBC that the incident appeared to be a "retaliation attack" and demonstrated that "no organisation is safe from the group." The expert suggested the hackers aimed to control the narrative surrounding their activities and protect their reputation.