Technology and Science23 September, 20263 min read
ShinyHunters Claims It Compromised FBIjobs.gov Data, FBI Investigates Kash Patel And Brett Leatherman
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
ShinyHunters claim breach of FBIjobs.gov, defaced site, stealing data on FBI employees and applicants. FBI says investigating unauthorized activity on FBIjobs.gov; data reportedly includes personal data and PII.
40 outlets told this the same way.
Jobs Portal Breach Claims
The FBI said it was investigating an apparent breach of FBIjobs.gov after a hacking group claimed it accessed “very sensitive data” on nearly all agents and job applicants. The FBI said it was “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating,” while the jobs website remained offline Wednesday morning. ShinyHunters directed its message to FBI Director Kash Patel and the assistant director in charge of the FBI's cyber division, Brett Leatherman, and claimed it had “compromised very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job.”
The FBI spokesperson declined to comment further, and the claims could not immediately be verified as the FBI continued investigating the incident. ShinyHunters said it would give the bureau one week to correct or remove what it says are false allegations in an FBI public service announcement from May that described the group as a “cyber criminal group specializing in large-scale data breaches and extortion.”
Data, Methods, and Dispute
ShinyHunters claimed it had breached the FBI and stole data on thousands of current and former employees, and it said it was holding the data hostage until the bureau rescinds an unflattering statement about the group issued in May. The FBI said the point of breach was undetermined, and the bureau said it was “actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.” Ars Technica reported that ShinyHunters told The New York Times that “About two to three terabytes of data were taken,” and the group’s sample was described as including “names of current and former agents as well as applicants and corresponding home addresses, phone numbers, names of spouses.”
404 Media reported that a ShinyHunters representative told it the data included “names, home addresses, phone number, and information on their spouse,” and the representative provided a sample appearing to contain personal data of 5,000 FBI employees. The dispute over motive and characterization sharpened as ShinyHunters said it was “severely offended” by the FBI’s May advisory and insisted, “We wish to state unequivocally our threats and claims are very real,” while the FBI’s May advisory characterized ShinyHunters as “threat actors” who “use their real or exaggerated claims” to prompt payment from victims.
National Security Risks Ahead
Cynthia Kaiser, a former FBI official and senior vice-president at cybersecurity firm Halcyon, said breaches like the one claimed by ShinyHunters were “incredibly harmful” because they could be used by criminals to expose and put pressure on people investigating them. Kaiser warned that once information is stolen, it is used “forever,” and she pointed to an old leak dating back to 2016 that is still occasionally used to harass FBI agents. Miriam Wugmeister, a lawyer specializing in data, privacy and cybercrime who tracks hacking outfits like ShinyHunters, said the hack had alarming national security implications because it could expose agents and their families to extortion, swatting and other harassment.
Wugmeister said, “Even if the agents and the analysts and the employees are sophisticated, you worry about their families too,” as the ShinyHunters message claimed identities of spouses were also obtained. The FBI said it had not determined whether the “point of breach” involved a “third-party or the FBI’s enterprise,” and it said it was working with vendors that support the jobs site to mitigate risk while the investigation continued.