ShinyHunters hackers claim to hold 2-3TB of sensitive FBI employee data

Hacking group ShinyHunters claims to have obtained a large volume of sensitive data from the US Federal Bureau of Investigation, including information on both agency employees and job applicants. Reuters says it has viewed a sample of the stolen data, while 404 Media received confirmation of the breach directly from a ShinyHunters representative. The same group appears to have also been behind an unauthorized takeover of the FBI's website earlier this week.

How the breach happened

According to the representative who spoke with 404 Media, the hackers exploited a zero-day vulnerability in Oracle's PeopleSoft software to gain access to Amazon Web Services' GovCloud servers. In a statement given to Reuters, the FBI acknowledged it was aware of a cyber-criminal group's claims of compromising the FBIJobs.gov portal and potentially affecting employee personally identifiable information, adding that it is actively investigating the matter.

What the stolen data contains

The attackers claim to hold a total of 2-3TB of data. The sample shared with media reportedly included names, addresses, phone numbers, dates of birth, social security numbers, and emergency contact details for 5,000 FBI employees. The group may also have obtained details about some agents' work assignments and about units handling intelligence, security, and counter-espionage work, including operations related to China and Russia.

A different motive this time

ShinyHunters' past attacks, targeting companies such as Ticketmaster and Rockstar Games, were largely financially motivated extortion attempts. This time, the representative told 404 Media the action was not financially motivated, but rather intended to pressure the FBI into removing or amending a statement made in May, in which the agency said the group had exaggerated claims of access to sensitive data in order to prompt victims to pay.