ShinyHunters hackers claim to have stolen data on almost every FBI employee

The cybercrime group ShinyHunters, responsible for numerous breaches at institutions, claimed in a post on its dark web site that it has stolen more than 2 terabytes of data containing detailed personal information on "almost every" FBI agent and on people who applied for jobs at the agency. The FBI confirmed through a spokesperson that it is "aware of reports of unauthorized activity affecting FBIjobs.gov" and that it is currently investigating the case.

According to the group, which responded by email to questions from Axios, the stolen data includes names, agent status, email addresses, phone numbers, home addresses and, in some cases, information about spouses, including their Social Security numbers. ShinyHunters also claims to have accessed criminal justice, human resources and other internal FBI services, and says it took over the FBI's jobs page and defaced it by exploiting a zero-day vulnerability in Oracle's PeopleSoft platform. That page was still down on Tuesday afternoon, the outlet confirmed.

Axios has not been able to independently verify that the leaked data is authentic or recent, although cybersecurity researchers consulted believe the attack appears to be legitimate. The outlet 404 Media, for its part, obtained a sample of the stolen data that reportedly includes information on some 5,000 alleged agents.

Notably, according to the group itself, the attack was not financially motivated: ShinyHunters says it wants the FBI to retract statements made in a May advisory in which the agency accused the group of resorting to harassment tactics, such as sending threatening text messages and making threatening calls to victims and their relatives, and in some cases of carrying out "swatting" (false alerts to trigger the deployment of armed police units). The group denies these practices and maintains that other "lower-level threat actors" have used its name to carry out such attacks.

Experts consulted by Axios agree on the seriousness of the episode. Cynthia Kaiser, a former senior official in the FBI's cyber division, noted that when an attacker targets the agency itself, it can be expected to mobilize additional resources to bring the perpetrator to justice more quickly. Allan Liska, a threat intelligence analyst at Recorded Future, warned that beyond the law enforcement attention ShinyHunters receives in the short term, the longer-lasting impact will fall on FBI employees themselves and their families, whose data is already circulating and being repeatedly downloaded and shared among other malicious actors.

Andrew Brandt, of the cybersecurity firm Huntress, highlighted as the main cause for concern the possibility that ShinyHunters decides to sell this information to other criminal groups or to state-backed actors, which would open up scenarios in which FBI employees or their relatives could be threatened or harmed as a result of the exposure of this data.