The FBI is investigating a major hack of its own network that could affect thousands of federal employees.
Notorious hacking group ShinyHunters has claimed responsibility for breaching the FBI’s servers, allegedly stealing agents’ personal data as well as information about their spouses.
The group posted on its dark web site Tuesday that it had stolen “very sensitive data on almost ALL FBI agents and individuals who filed an application with the FBI for a job,” via Axios.
A job application portal on the FBI’s website was taken down amid the mammoth data breach. The group also claims it broke into other services, including the FBI’s human resources department.
“The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating,” the bureau said in a statement to CNN.
According to 404 Media, the group stole information from around 5,000 FBI agents.
ShinyHunters said it hacked into the FBI’s systems after becoming “annoyed” by a warning the bureau issued about the group in May.
The FBI has described ShinyHunters as a criminal cybercrime gang specializing in large-scale data breaches and extortion.
“To exert pressure on victims, SH actors commonly use harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting,” the FBI’s public advisory said.
ShinyHunters denied the allegations, telling Axios that the FBI is mistaking the group for “other low-skilled threat actors” who have been using its name in their own cyberattacks.
The group added that it wants the FBI to retract its previous remarks about them, and said the hack was not financially motivated.
Experts have warned about the implications of personal information belonging to potentially thousands of FBI agents being sold or passed on to criminals or foreign adversaries.
“The data is out there and has likely been repeatedly downloaded and passed around to other threat actors,” Allan Liska, a threat intelligence analyst at Recorded Future, told Axios.
Andrew Brandt, principal threat intelligence incident commander at Huntress, added: “It doesn’t take much imagination to picture scenarios where employees or their families could be threatened or harmed by this kind of information being released.”
The Daily Beast has contacted the FBI for comment.
