ShinyHunters’ alleged breach of the FBI looked bad when we first reported it last week. It has gotten worse.
A lot worse.
Last week, ShinyHunters claimed it stole between two and three terabytes of FBI data, including names, home addresses, phone numbers, dates of birth, and information on employees’ spouses. The group backed it up by giving reporters a sample of roughly 5,000 FBI employee records, some of which matched Justice Department personnel.
At the time, the FBI had not confirmed that ShinyHunters actually got what it claimed.
The FBI now says it is investigating the breach. What it still does not know, or has not disclosed, is exactly how ShinyHunters got in. The bureau said investigators are looking at whether the hackers breached FBI systems directly or got through a third-party provider supporting FBIJobs.gov.
The bureau said:
“While the point of breach is still undetermined — whether a third-party or the F.B.I.’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.”
And the material reporters have now seen goes well beyond names and phone numbers.
Documents provided by ShinyHunters include sensitive psychiatric and medical evaluation records belonging to FBI personnel. Reuters checked two Social Security numbers in the files against credit bureau data. It also matched the date of a pre-employment mental health evaluation with the employment history of a former FBI analyst. Other details in the files were independently matched as well.
The details in those records are striking.
One file contained the results of a fitness-for-duty examination, including blood and urine test results and doctors' notes. Another referred to a prospective employee having experienced symptoms of depression in high school. A third contained an electrocardiogram result. ShinyHunters claims the larger cache includes prescriptions, clinical visits, medical discharges, and other health information. Each record includes the agent's full name and home address alongside the medical details.
Etay Maor, vice president of threat intelligence at Cato Networks, explained why that combination is particularly damaging:
“Passwords can be reset if stolen, but medical records cannot, so once this data is out, it stays compromised for good. That permanence, applied across an entire workforce, is what makes this leak so serious.”
The scale of the breach is growing too. The FBI has roughly 38,000 current employees, but ShinyHunters now says it underestimated its haul. The hackers claim they have sensitive information on approximately 60,000 current and former FBI personnel. The FBI has not independently confirmed that number.
At least some of those records may involve people working the bureau's most sensitive cases. Information obtained in the breach reportedly includes details about FBI personnel and assignments involving Chinese spies, Russian intelligence, drug cartels, and other sensitive work.
Former FBI operative Eric O’Neill compared the potential magnitude to the 2015 Office of Personnel Management breach, which exposed millions of sensitive federal personnel records. He pointed directly to what foreign intelligence services could do with the material:
“I would be shocked if Russian intelligence isn't knocking on their door and saying, ‘We want that stuff, hand it over.’”
ShinyHunters says it reached several FBI systems, including MedLink, which stores personnel medical records, as well as systems used for employee and applicant background investigations. Those specific access claims have not been independently corroborated.
ShinyHunters initially said it would publish the full dataset within days unless the FBI retracts a May advisory accusing the group of using threatening and coercive tactics against victims. Since then, the group removed that ultimatum from its site and told Reuters it would not comment on what it would do if the FBI doesn't comply.
Reporters have now authenticated portions of the stolen data. Medical records have surfaced. Blood and urine results are reportedly in the haul. And the hackers now claim the number of current and former FBI personnel caught up in this could reach 60,000.
The question now is what the FBI does over the next several days.
Editor's Note: Do you enjoy RedState's conservative reporting exposing the radical left and woke media? Support our work so we can keep bringing you the truth.
Join RedState VIP and use promo code FIGHT to receive 60% off your membership.
Join the Conversation
VIP members get the ability to comment on articles.