Threat hunters and researchers are alarmed by what they’ve seen in data ShinyHunters claims it stole from the FBI. Limited samples of the stolen data contain FBI agents’ personal contact information, details on family members, office and duty assignments and, in some cases, information on agency personnel specialties, multiple sources said.
“I am gravely concerned about the implications it opens up,” a researcher who has viewed and studied a sample of the data told CyberScoop.
“It’s a roadmap for every s—y country, and drug cartel, and insane person to locate exactly who in the FBI they have a grievance with, and show up at their home or attack a person close to them,” the researcher who requested and was granted anonymity to share sensitive information added.
In a lengthy post on its data-leak site, the group claimed it stole data on almost every FBI agent and people who applied for an agency job. The FBI jobs site, which was temporarily defaced by ShinyHunters, remains offline as of Monday.
The FBI hasn’t confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly. The agency said it is “actively and aggressively investigating” the incident, the root cause and its alleged impact to FBI employees’ personally identifiable data in a statement Wednesday.
Stolen data puts FBI agents at serious risk
While the full scope of the attack remains under investigation, cybercrime experts are startled by the potential counterintelligence exposure and safety risks lurking in data ShinyHunters has shared with journalists in a bid to bolster its claims and mount public pressure on the FBI. CyberScoop has not viewed the stolen data.