FBI Director Kash Patel and Defense Secretary Pete Hegseth’s workplaces have each suffered a data breach.
On Friday, new details emerged about information obtained from the FBI’s servers by hacking group ShinyHunters—a breach that first came to light earlier this week.
Among the files in the alleged two to three terabytes of data, Reuters reported, are FBI personnel’s medical and psychiatric evaluations. For instance, one record noted an applicant’s aspirin usage and their allergies to dust and cats. Another applicant was marked as having “symptoms of depression” in high school. Another record contained the results of an electrocardiogram, a test that measures the heart’s electrical activity.
The BBC reported Friday that one record contained a blood and urine test document, while another noted an individual’s “shellfish and banana allergy.”
The breach is likely to spark the interest of adversaries of the U.S.
“I would be shocked if Russian intelligence isn’t knocking on their door and saying, ‘We want that stuff, hand it over,’” cybersecurity consultant and former FBI operative Eric O’Neill told Reuters.
The FBI declined to comment to Reuters, and a spokesperson did not immediately respond to a Daily Beast request for comment.
In a statement earlier this week, the bureau said it was “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”
Meanwhile, a breach of the Pentagon’s human resources system has also raised alarms.
This data breach began last October, CNN reported, but it wasn’t until July when it was finally discovered and fixed. Among the information “unauthorized users” obtained from the Defense Manpower Data Center (DMDC) were Social Security numbers and other personal information belonging to current and former personnel, according to a letter from DMDC to victims.
Service members’ “occupational specialty” was one data point accessed in some instances. According to Military Times, four million individuals could have had their information exposed.
The letter says the Pentagon “does not have any indications of misuse” of the data, which was not encrypted. But, as is the case with the FBI data breach, this breach could still generate interest of malevolent foreign actors or cybercriminals.
“We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system,” the letter says.
The DMDC housed at least 60 million records in the 2024 fiscal year.
“The services and access to data we provide support so many vital government entities, including the legislative branch, human services, national defense, labor, healthcare, finance, veterans affairs, research, and more,” its website says.
The Pentagon did not immediately respond to a request for comment from CNN or the Daily Beast.
