A hacking group known as ShinyHunters has claimed it breached an online job portal linked to the US Federal Bureau of Investigation (FBI) and stole thousands of highly sensitive records belonging to current and former FBI personnel and job applicants.
The group made the claim on Tuesday, saying the stolen information includes names, home addresses, phone numbers, spouses’ names, certain medical information and other personal details. It has not, however, publicly released the data so far.
In an online message addressed to FBI Director Kash Patel and the agency’s cybersecurity chief Brett Leatherman, ShinyHunters claimed it had “breached the FBI’s security perimeter” and obtained sensitive information on nearly all FBI agents and job applicants.
The FBI has acknowledged awareness of the alleged breach and said it is investigating.
“We are actively and aggressively investigating the matter and working closely with third-party service providers supporting FBIJobs.gov to mitigate any potential risks,” an FBI spokesperson said, adding that investigators had yet to determine whether the alleged breach originated with a third-party provider or an FBI system.
The FBI’s recruitment website remained inaccessible on Wednesday morning. A banner displayed on its homepage the previous day claimed that the site had been taken over by ShinyHunters.
The hackers told The New York Times that they possessed records containing personal information on more than 10,000 people. Cybersecurity news outlet 404 Media was the first to report the alleged breach.
Former FBI officials and cybersecurity experts who monitor cybercriminal activity said the claim appeared credible, warning that a leak of such information could pose serious security and counterintelligence risks.
If the information were published on the dark web, intelligence agencies from countries such as China or Russia could potentially obtain it and use the data for intelligence operations, experts said.
Suman Dantiki, a partner at Baker McKenzie and a former senior cybersecurity official at the FBI and US Department of Justice, said that if the breach is confirmed, it would demonstrate that no organisation is immune to cyber threats. He warned that the incident could create significant public-safety and counterintelligence risks.
Former FBI senior official Cynthia Kaiser, who previously oversaw major cyber investigations, pointed to another potential danger: criminals prosecuted by FBI agents could use leaked personal information to retaliate against them.
FBI agents generally take precautions to prevent sensitive information such as home addresses and family relationships from becoming easily accessible online, particularly because such details can expose them and their relatives to threats.
ShinyHunters is a well-known hacking group that has been active for years and has claimed responsibility for several major data breaches. Security researchers have also said the group has sometimes exaggerated or fabricated aspects of its operations, although its involvement in several significant hacks has been substantiated.
The group claimed in May that it had hacked Canvas, an online learning platform used by thousands of schools and universities worldwide. That incident prompted an FBI warning about the group.
ShinyHunters has also claimed responsibility for the 2024 Ticketmaster cyberattack, which exposed data involving hundreds of millions of customers.
The alleged FBI breach has revived comparisons with the massive 2015 Office of Personnel Management (OPM) cyberattack, in which records relating to nearly 20 million US government employees and contractors were stolen. The Obama administration blamed the Chinese government for that breach, which became one of the most serious cybersecurity failures in US government history.
Former FBI officials said they were particularly concerned that such a large volume of valuable personnel information could have been stored in an online database connected to a recruitment portal.
The alleged breach is also the latest in a series of cybersecurity concerns involving the FBI. Earlier this year, the agency reportedly detected Chinese hackers inside a database used for domestic surveillance orders. US officials had previously linked a broader Chinese intelligence operation to compromises of American telecommunications infrastructure.
In March, Patel’s personal email account was also reportedly hacked and leaked by a pro-Iranian hacktivist group linked to Iran’s intelligence and security apparatus.
ShinyHunters said it exploited a previously undiscovered “zero-day” vulnerability in Oracle PeopleSoft software, which is used by organisations for human resources and financial management. The group declined to provide details about the alleged vulnerability, saying it intended to use the zero-day as part of its “normal business activities.” Oracle did not respond to requests for comment.
It remains unclear what the hackers intend to do with the estimated two to three terabytes of data if the FBI does not withdraw its warning about ShinyHunters.
Cybersecurity firm Flashpoint said the hackers could potentially release the stolen information online, as they have done with data obtained from other corporate victims.
ShinyHunters denied that its actions amounted to blackmail and said it had no financial motive.
“Our only purpose, target and motivation is to bring the truth to light,” the group said in an email to The New York Times.
COMMENTS