‘We Hacked the FBI’: Hackers Say They Have Data on All FBI Employees

An established hacking group says it broke into several FBI-related services and stole data covering “all FBI employees and applicants,” including the personal information of serving agents.

What ShinyHunters claims

A representative of the group, known as ShinyHunters, told 404 Media that the stolen records include agents’ names, home addresses, phone numbers, and in some cases information about their spouses. The group provided the publication with a sample appearing to contain the personal data of 5,000 FBI employees, listing alleged addresses, phone numbers and dates of birth.

ShinyHunters also defaced the FBI jobs website on Tuesday, leaving a message saying “this site has been seized by ShinyHunters” — a deliberate echo of the seizure notices U.S. law enforcement places on sites it takes down. The group said the intrusion happened on Monday night.

How the breach allegedly happened

According to the group’s representative, ShinyHunters used a zero-day exploit in an Oracle product called PeopleSoft to reach AWS GovCloud servers and download the data. The representative put the volume of exfiltrated data at between two and three terabytes. The defacement claimed that “all FBI data was compromised,” including PII/PHI on current and former employees and all applicant records.

FBI response and verification

An FBI spokesperson told 404 Media by email that the bureau “is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” 404 Media checked part of the sample: some phone numbers matched people with the same names via the open-source tool OSINT Industries, and the compromised-data tool Darkside, made by cybersecurity firm District 4, showed some numbers belong to U.S. Department of Justice personnel.

Why it matters

The data could have serious national security and counterintelligence consequences. Criminals from the same ecosystem as ShinyHunters have previously used stolen phone records to track, intimidate and harass the FBI agents investigating them, and foreign intelligence agencies could use such records to better understand how the bureau operates.

ShinyHunters has typically hacked a target and then demanded payment, threatening to publish more data if no fee is paid. Asked whether the group would try to extort the FBI, its representative said: “what we plan to do is not something I’d call extortion, maybe coercion,” adding that the campaign is “not financially motivated.” On its leak site, the group said the FBI had made “false allegations” in a previously published report and gave the bureau one week to correct or remove it. The FBI has previously accused the group of exaggerating its claims to extract payment and of harassing victims.