A hacking group calling itself ShinyHunters claims it breached multiple FBI computer systems, defaced the bureau’s public jobs website, and stole between two and three terabytes of data on current and former employees, as well as job applicants. The alleged haul includes names, home addresses, phone numbers, dates of birth, and information about employees’ spouses.
The FBI has not confirmed the breach and did not respond to requests for comment Tuesday. Reuters separately confirmed that ShinyHunters was claiming responsibility for the attack and the theft of employee data.
ShinyHunters provided the outlet 404 Media with a sample it said came from the breach, containing what it described as the personal data of 5,000 FBI employees, including alleged addresses, phone numbers, dates of birth, and in some cases spouse information. 404 Media checked some of the phone numbers using the open-source intelligence tool OSINT Industries and found they corresponded to people with the same names listed in the sample file. Using a separate tool called Darkside, made by cybersecurity company District 4, 404 Media found that some of the phone numbers were associated with U.S. Department of Justice personnel.
In a statement, the group described its own version of events:
“We hacked the FBI. We hold data on all FBI employees and applicants. We have names, addresses, phone numbers, dates of birth, and health information. We have data on their spouses. We breached HR, MedLink, and Criminal Justice Information Services. This was not about money. The FBI lied about us and we want them to retract it.”
ShinyHunters also defaced the FBI’s jobs website on Tuesday, posting a message claiming the site had been “seized by ShinyHunters” and that personal and health information belonging to employees, former employees, and job applicants had been compromised. By Tuesday afternoon, both the public-facing jobs portal and the FBI’s Special Agent Applicant Portal were showing as unavailable.
How the group says it got in
ShinyHunters claims the breach began with a zero-day exploit in Oracle’s PeopleSoft software, which it says allowed access to FBI-managed Amazon Web Services GovCloud servers, from which it downloaded two to three terabytes of data. The group told the tech outlet The Register that the intrusion reached FBI operations, human resources, MedLink, and Criminal Justice Information Services. Neither Oracle nor AWS have publicly responded to the claims.
A representative for the group told The Register the attack was “NOT financially motivated,” saying instead that ShinyHunters wants the FBI to retract what it characterizes as false allegations about its methods.
A public dispute with the bureau
In May, the FBI issued a bulletin warning the public about ShinyHunters, accusing the group of making threatening calls and texts to victims and their family members and, in some instances, engaging in swatting. The bureau also alleged the group has falsely claimed to possess compromising photos or videos of victims. ShinyHunters denies those allegations.
Whether the breach occurred as described remains unconfirmed. The FBI has not verified the claims, and it is unclear how many current and former employees may be affected if the stolen data is authentic.
You must be logged in to post a comment Login