FBI investigates ShinyHunters claim of major personnel data theft

The FBI is investigating claims that the hacking group ShinyHunters breached its jobs portal and stole a large collection of sensitive records concerning current and former employees and job applicants.

The bureau said it was aware of a claimed compromise of FBIJobs.gov and a possible impact on employees’ personally identifiable information. It said investigators were working with third-party providers supporting the website to determine whether the point of entry was an FBI system or an outside service and to mitigate risks.

ShinyHunters claims it obtained two to three terabytes of data. Samples reviewed by Reuters, the BBC and other news organizations appeared to include names, home addresses, phone numbers, dates of birth, Social Security numbers, badge numbers, medical information, emergency contacts and details about spouses. Some records also reportedly describe employees’ assignments, including counterintelligence work involving China, Russia and Iran, investigations of drug cartels, and membership in the FBI’s secretive Remote Operations Unit.

The full scope and authenticity of the claimed theft have not been independently established. The FBIJobs.gov website was taken offline after attackers apparently defaced it with a message saying it had been seized by ShinyHunters.

The group said its objective was not money. Instead, it threatened to publish the data unless the FBI removed or revised a May advisory describing ShinyHunters as threat actors who sometimes use exaggerated claims and harassment to pressure victims into paying.