FBI investigates claimed data breach of agent records by hacking group ShinyHunters

The FBI said it is investigating a possible breach of its online jobs portal after the cybercriminal group ShinyHunters publicly claimed to have stolen personal data on nearly all of the bureau’s agents and job applicants.

The FBI’s National Press Office said in a statement that the bureau is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating. The statement came hours after ShinyHunters posted online claiming to have stolen data on "almost all" FBI agents and people who had applied for jobs at the bureau, describing it as "very sensitive."

The group gave 404 Media, which first reported the alleged hack, a sample of data affecting 5,000 supposed FBI agents. The sample reportedly included agents’ names, home addresses, phone numbers, Social Security numbers, job assignments and, in some cases, information about spouses or other family members.

Reuters said it was able to partially verify the sample by checking the information, including the Social Security numbers, against credit bureau records and previously breached data held by dark-web intelligence firm District 4 Labs, and found matching details in at least 10 instances, including one involving FBI Director Kash Patel. Reuters said it could not determine where the data came from or confirm it was taken from the FBI’s internal systems as the hackers claimed, and could not reach the individuals named in the sample.

Both FBIjobs.gov and the FBI’s Special Agent Applicant Portal displayed messages Tuesday saying they were unavailable. People with knowledge of the breach said investigators believe ShinyHunters’ claims are credible and could represent a serious counterintelligence failure, since identifying information on even a small number of agents could be used to threaten or harass them or their families and would be of interest to foreign intelligence services and criminal groups.

One person familiar with the matter said the intrusion appeared to exploit a vulnerability in Oracle PeopleSoft, human resources software the FBI uses; a person claiming to represent ShinyHunters told 404 Media the group used a previously unknown vulnerability, though investigators have not confirmed that. In June, ShinyHunters used an unpatched flaw in PeopleSoft in a separate campaign before Oracle fixed it, and investigators are still determining whether the group reused that exploit or found another way into the FBI’s systems.

The claimed breach follows an April intrusion in which hackers linked to China accessed an FBI wiretap system, one of the most serious breaches of the agency’s systems in recent years. ShinyHunters said its latest attack was retaliation for a May public service announcement in which the FBI detailed the group’s tactics after it disrupted the Canvas learning platform, leaving thousands of schools and universities temporarily offline; the group said the attack was meant to pressure the FBI into revising or removing that alert, and denied allegations that it has carried out sextortion schemes.

Cynthia Kaiser, a former deputy assistant director of the FBI’s Cyber Division who is now a senior vice president at cybersecurity firm Halcyon, said the retaliatory nature of the attack was "very atypical behavior for ransomware gangs, but goes to show you the unpredictability and immaturity of the group." She said breaches like this one are "incredibly harmful" because they can be used to expose and pressure the people investigating criminals, noting that a 2016 leak of FBI information is still occasionally used to harass agents today.