Infamous hacking group ShinyHunters claims to have stolen data on every FBI employee and applicant, and defaced the bureau’s jobs website to prove it. The hackers claim to have breached the FBI by exploiting Oracle’s Peoplesoft platform.
“We hacked the FBI. We hold data on all FBI employees and applicants,” a representative for the group told 404 Media. The claim came alongside the defacement of apply.fbijobs.gov on Tuesday, which a representative said was carried out Monday night. The FBI jobs site and its Special Agent Applicant Portal were listed as “currently unavailable” at the time of writing, with the site itself displaying the message: “Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable.”
The defacement message was styled after a law enforcement seizure notice. It read “this site has been seized by ShinyHunters,” then claimed a far broader compromise than the website alone: “All FBI data was compromised including PII/PHI [personally identifiable information and protected health information] on incumbent and former FBI employees and all applicant information. We have a lot more than we claim here.”
404 Media reviewed a sample of the alleged stolen data covering 5,000 purported agents, including names, home addresses, phone numbers, dates of birth, and details about employees’ spouses. Reporters cross-checked phone numbers in the sample using the OSINT Industries tool and found they matched the same names listed in the file. A separate check using Darkside, a compromised-data tool built by cybersecurity company District 4, turned up some phone numbers associated with personnel at the U.S. Department of Justice.
ShinyHunters said it got in through a zero-day exploit in Oracle’s PeopleSoft software, then used that foothold to reach AWS GovCloud servers and download data. A representative told 404 Media the group pulled between two and three terabytes of information.
This isn’t the group’s usual playbook. ShinyHunters typically hacks a victim and threatens to leak the data unless it gets paid. The group told 404 Media, “This is not financially motivated.”
The potential hack seems to trace back to a dispute over an FBI report on the group. The report said ShinyHunters exaggerates its access to victims’ systems to pressure them into paying, sends threatening messages and calls to victims and their families, and has in some cases carried out swatting attacks. ShinyHunters posted on its leak website calling the report’s contents “false allegations” and demanding a correction, giving the bureau, in its words, “a time of 1 week to correct” or remove the report.
An FBI spokesperson responded to 404 Media after the article was first published, confirming the bureau was looking into the matter: “The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”
Breitbart News reported in May that ShinyHunters shut down Canvas, the tech platform that runs many schools from K-12 all the way to college. Instructure, the company behind Canvas, chose to pay ShinyHunters’ ransom to end the attack.
Read more at 404 Media here.
Lucas Nolan is a reporter for Breitbart News covering issues of AI, free speech, and online censorship.