FBI rushes to investigate if ShinyHunters hack of thousands of employees is real

The FBI is investigating claims that ShinyHunters, a hacker group, exploited a previously unknown software vulnerability to steal two to three terabytes of data from FBIJobs.gov, including personal information on thousands of current and former employees, their families, and job applicants.

On Tuesday, 404 Media first reported that ShinyHunters took the agency site offline and replaced its homepage with a banner reading "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS." According to The New York Times, the stolen data included names, home addresses, phone numbers, spouses' names, and certain medical information for current and former FBI agents as well as applicants.

Bloomberg reported that the compromised data contained potentially sensitive professional details, with some samples showing information on FBI employees' work focus areas including counter-intelligence operations on China, Russia, and Iran, as well as work against street gangs. Such information could potentially be used to retaliate against agents.

The Group's Stated Motive

ShinyHunters stated that the breach was not intended as extortion or a ransom demand. Instead, the group said it sought to force the FBI to remove or edit a May advisory that warned about ShinyHunters, claiming the advisory contained "disinformation" meant to disrupt their operations.

"We wish to state unequivocally our threats and claims are very real. Not exaggerated and never a bluff."

The FBI's May advisory had alleged that ShinyHunters sometimes uses exaggerated claims to extract payments from victims and conducts swatting attacks and sextortion threats. ShinyHunters disputed these characterizations, stating that such activities "never" occur.

Technical Details and Timeline

ShinyHunters told The New York Times that it weaponized a zero-day—a previously undiscovered computer bug—within Oracle PeopleSoft software, an application widely used for human resources and financial management. According to reports, Oracle has not yet commented on the vulnerability, while ShinyHunters indicated it plans to continue using the zero-day for its normal operations.

The group demanded that FBI Director Kash Patel and Brett Leatherman, assistant director of the FBI Cyber Division, comply with its demands within one week or face a breach of sensitive employee data. As of publication, no data has been publicly leaked.