Hackers Claim to Have Breached the FBI and Stolen Data on Every Employee

The prominent hacking group ShinyHunters claims it breached several FBI-related services and stole data "on all FBI employees and applicants." According to a group representative cited by 404 Media, the trove includes agents' names, home addresses, phone numbers, and information on their spouses.

What the sample showed

The representative gave 404 Media a sample appearing to hold personal data on 5,000 FBI employees: an alleged address, phone number, date of birth, and in some cases details on a spouse. Reporters ran several of the phone numbers through the OSINT tool OSINT Industries and found they matched people with the same names as in the file. A search through another tool, Darkside from the firm District 4, showed some numbers are tied to U.S. Department of Justice personnel.

On Tuesday ShinyHunters also defaced the FBI jobs website. The message "this site has been seized by ShinyHunters" is an obvious dig at the seizure notices the bureau and other agencies post on sites they take down. At the time of writing, the fbijobs site said its applicant portal was unavailable. The hackers added that all FBI data had been compromised, including personal and health information on current and former employees, and that they hold "a lot more than we claim here."

How it may have been done

The representative said the group used a zero-day exploit in Oracle's PeopleSoft product, then reached AWS GovCloud servers and downloaded the data — an estimated two to three terabytes.

If the claims hold up, the fallout could be severe. Criminals from the same ecosystem as ShinyHunters have previously used stolen data like phone records to track and intimidate the agents investigating them. Such information would also be valuable to foreign intelligence services, and if it reached other criminals, agents and their families could face direct danger.

ShinyHunters usually extorts victims by threatening to publish stolen data. That the FBI would pay a ransom seems unlikely. Asked about extortion, the representative was coy: "what we plan to do is not something I'd call extortion, maybe coercion," adding that the motive is "not financially motivated." The announcement closed with a jab at President Trump's posting style: "Thank you for your attention to this matter." The FBI did not immediately respond to a request for comment.

Source: 404 Media