FBI investigates hack claims involving staff medical records

The hacking group ShinyHunters has shared documents it says contain FBI staff medical records, including blood and urine test results, as the bureau investigates claims that its recruitment portal was compromised. [1] [2]

BBC News reported seeing samples of purportedly stolen fitness-for-work examinations containing doctors’ notes, agents’ full names and addresses, and laboratory results. Reuters separately reported that files supplied by the group included a pre-employment mental-health evaluation and an electrocardiogram result. [1] [4]

In a statement on 23 September, the FBI said it was investigating the alleged compromise of FBIJobs.gov and potential exposure of employees’ personal information. It said the point of entry remained undetermined — whether through a third-party provider or the FBI’s own systems — and that it was working with companies supporting the portal to mitigate risks. [2]

Scale remains unclear

ShinyHunters told the BBC it held sensitive information about around 60,000 current and former FBI staff. The number of people affected, and how many medical records may be involved, remains unclear. [1]

Reuters also described a 5,000-line spreadsheet supplied by the hackers containing names, addresses, telephone numbers, dates of birth, Social Security numbers and emergency contacts. Some entries identified field-office postings and assignments involving intelligence, security or counterespionage work. The line count is not a count of unique people affected. [5]

Quoted by the BBC, CyberSmart chief executive and co-founder Jamie Akhtar cautioned that the hackers’ claims should be treated carefully, but warned that such information could enable convincing phishing, impersonation, identity fraud and blackmail, or operations targeting law-enforcement personnel. [1]

Demand for an FBI retraction

The BBC reported that ShinyHunters was seeking a retraction of an FBI advisory published in May rather than demanding money. That advisory warned that the group used real or exaggerated claims of access to sensitive information to pressure victims into paying, alongside harassment of victims and their families. [1] [3]

The group has given differing statements about what would happen next. In its 25 September report, the BBC said the hackers had threatened to publish the full dataset within five days unless their demands were met. A Reuters dispatch that day said ShinyHunters had removed its demand from its website and had declined on 24 September to explain what it would do if the FBI did not comply. [1] [4]