FBI investigates hackers’ claim to have stolen staff and applicant data

The FBI is investigating an alleged compromise of its recruitment website after ShinyHunters claimed to have obtained sensitive records on agents, other employees and job applicants.

In a statement dated 23 September, the bureau said it was working with companies supporting FBIJobs.gov. It had not determined whether the alleged breach originated with a third-party provider or within its own systems, and did not confirm theft affecting its entire workforce. [1]

The hackers claim the records include names, roles, badge numbers, home addresses, phone numbers and information about spouses, according to the BBC. [8]

What has been checked

Some news organisations have examined samples. 404 Media reported seeing material concerning 5,000 alleged agents, while the BBC said a small portion it inspected appeared genuine. Those assessments do not establish where the records came from, when they were obtained or whether the much larger collection claimed by the hackers exists. [9] [8]

The group’s descriptions of the scale have also varied. An archived statement claims information on almost all FBI agents and people who applied for jobs; a representative told The Register it held data on all employees and applicants. Neither claim has been independently established. [2] [10]

The FBI’s staffing FAQ lists approximately 38,000 employees, including both special agents and support professionals. That is a workforce estimate, not a confirmed count of people affected. [5]

The potential sensitivity extends beyond contact details. Nextgov/FCW, citing two people familiar with the matter, reported that a sample was believed to include information on hundreds of intelligence analysts and other staff involved in clandestine intelligence gathering and surveillance. That account is not a public forensic finding and does not establish operational damage. [11]

Threat to publish the records

In a statement archived under 22 September, ShinyHunters gave the FBI one week to correct or remove an earlier warning containing allegations the group disputes. The BBC reported that the hackers threatened to publish the full databases if the bureau did not comply. The precise deadline was not specified. [2] [8]

The FBI’s May public service announcement described harassment and the use of real or exaggerated claims of access to sensitive information to pressure victims into paying. It advised recipients not to pay or respond to demands. That warning sets out the bureau’s allegations about the group’s methods; it does not resolve whether the September theft claim is genuine. [3]