According to two anonymous sources, data stolen during a major hacking group’s alleged breach of FBI systems contains personal information on hundreds of FBI intelligence analysts and other employees involved in covert intelligence-gathering and surveillance.
These analysts focus on a wide range of subjects, including Russia, China, Hezbollah, and cartel-related intelligence. The sources, who spoke anonymously due to the sensitivity of the exposures, noted that while the employees’ roles only provide a limited view of their duties, they could still help outsiders identify individuals working in sensitive areas of the bureau.
ShinyHunters claimed responsibility for the breach on Monday, threatening to release two to three terabytes of FBI employee data unless the agency retracted a public warning regarding its tactics within a week.
On Tuesday, the group sent an apparent sample of this data to Nextgov/FCW and other news outlets. The sample contained roughly 5,000 entries listing employees’ names, home addresses, phone numbers, and information about their spouses and siblings.
Many of the exposed individuals also work in human intelligence-gathering, as well as roles involving electronic surveillance that utilize telecom interception techniques and other covert access mechanisms. Some employees belong to the FBI’s Remote Operations Unit, which develops specialized tools to target computers and networks.
One individual works in the bureau’s FISA Management Unit, which processes applications and renewals under the Foreign Intelligence Surveillance Act. This act governs the surveillance and search standards used to collect foreign intelligence.
The FBI acknowledged awareness of “a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information” and stated that it is investigating the matter.
The agency noted that the cause of the breach remains undetermined. ShinyHunters previously claimed to have exploited vulnerabilities in Amazon and Oracle services to access the data; however, neither company has responded to a request for comment.
Reuters and 404 Media previously reported details regarding the intelligence roles and the Remote Operations Unit staff.
The language ShinyHunters wants removed appears in a May 15 FBI public service announcement describing practices the hacking group contests. The group has built a global reputation for various hacking achievements, including a May claim of responsibility for accessing Canvas, a popular education technology platform used by thousands of U.S. institutions.
Etay Maor, vice president of threat intelligence at Cato Networks, described the direct claim of an FBI breach as “an unusually provocative move” that should be taken seriously.
The exposure of sensitive bureau staffing data could pose profound counterintelligence risks. For employees who do not publicly identify as FBI personnel, the exposure could reveal their jobs and how to reach them outside secure work environments. Linking this information to home addresses and relatives’ details could make it easier for nation-state groups and cybercriminals to target employees and their families with harassment, scams, or threats.
Doc McConnell, a former cyber policy official at the White House and the Cybersecurity and Infrastructure Security Agency, said the breach would be “troubling news” for both FBI employees and applicants.
McConnell, who currently heads policy and compliance at Finite State, compared the incident to the Office of Personnel Management hack a decade ago.
He noted, “The breach of OPM’s personnel records in 2015 resulted in a decade of credit monitoring for millions of affected individuals, and the full counterintelligence impact will likely never be known. This breach appears to contain similar data, creating potential security concerns for the victims if it is made publicly available.”
Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former deputy director of the FBI’s Cyber Division, stated that the bureau will likely work more assertively to dismantle ShinyHunters. When any group directly targets the agency, “they should expect that the FBI is going to marshal additional resources to bring them more quickly to justice,” she said.
The incident follows other cyberattacks involving the bureau and its leadership this year. In March, the pro-Iran hacking group Handala published material from FBI Director Kash Patel’s personal email account, which the bureau said contained historical information unrelated to government business. Separately, a suspected China-linked intrusion into an FBI system exposed surveillance targets’ phone numbers.
Also Read
- Corn Futures Slip as Traders Reduce Exposure Before US-China Talks
- US judge blocks Trump ban of CNN, MS NOW, Politico from White House, orders him to restore access
- Life Lab Resources grabs US$1M to turn food waste into aquaculture feed
- Pakistan Conducts Airstrikes on Drone Storage Sites in Afghanistan Amid Rising Tensions